{ "openapi": "3.1.0", "info": { "title": "Didit Credentials API", "version": "1.0.0", "description": "OpenID4VCI 1.0 issuance + OpenID4VP 1.0 verification (SD-JWT VC, draft-16) with a multi-tenant management plane: credentials, presentations, verifications, a trust registry (frameworks, trusted issuers, relying parties), and issuer key rotation. Management endpoints authenticate with a tenant API key (`Authorization: Bearer `); the OpenID4VCI/VP protocol + holder/verifier endpoints are public." }, "paths": { "/v1/tenant/bootstrap": { "post": { "operationId": "v1_tenant_bootstrap_create", "description": "Exchange a user access token for a tenant API key (first call seeds the tenant's signing key + demo schemas).", "tags": [ "Other" ], "responses": { "200": { "description": "No response body", "content": { "application/json": { "schema": { "type": "object", "properties": { "api_key": { "type": "string", "example": "" }, "email": { "type": "string", "example": "docs-capture-6clew6@diditcapture.dev" }, "environment": { "type": "string", "example": "sandbox" }, "role": { "type": "string", "example": "owner" }, "seeded": { "type": "boolean", "example": true }, "tenant": { "type": "object", "properties": { "name": { "type": "string", "example": "docs-capture-6clew6" }, "slug": { "type": "string", "example": "docs-capture-6clew6" } } } } }, "example": { "api_key": "", "email": "docs-capture-z2373a@diditcapture.dev", "environment": "sandbox", "role": "owner", "seeded": true, "tenant": { "name": "docs-capture-z2373a", "slug": "docs-capture-z2373a" } } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Exchange a user access token for a tenant API key (first call seeds the tenant's signing key + demo schemas).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/members": { "get": { "operationId": "v1_members_retrieve", "description": "List the tenant's team members + roles.", "tags": [ "Other" ], "responses": { "200": { "description": "No response body", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "capabilities": { "type": "array", "items": { "type": "string", "example": "create:credential-schemas" } }, "created_at": { "type": "string", "example": "2026-07-02T23:33:32.239688+00:00" }, "email": { "type": "string", "example": "docs-capture-6clew6@diditcapture.dev" }, "name": { "type": "string", "example": "docs-capture-6clew6@diditcapture.dev" }, "role": { "type": "string", "example": "owner" } } } }, "example": [ { "capabilities": [ "create:credential-schemas", "create:credential-templates", "create:credentials", "create:presentations", "create:relying-parties", "create:trust-frameworks", "create:trusted-issuers", "delete:credential-schemas", "delete:relying-parties", "delete:trust-frameworks", "delete:trusted-issuers", "write:credential-schemas", "write:credentials", "write:members", "write:signing-keys", "write:trust-frameworks", "write:trusted-issuers" ], "created_at": "2026-07-02T23:51:56.416502+00:00", "email": "docs-capture-z2373a@diditcapture.dev", "name": "docs-capture-z2373a@diditcapture.dev", "role": "owner" } ] } } } }, "security": [ { "bearerAuth": [] } ], "summary": "List the tenant's team members + roles." }, "post": { "operationId": "v1_members_create", "description": "Invite a team member with a role.", "tags": [ "Other" ], "responses": { "201": { "description": "Successful response.", "content": { "application/json": { "schema": { "type": "object", "properties": { "capabilities": { "type": "array", "items": { "type": "object", "properties": {} } }, "created_at": { "type": "string", "example": "2026-07-02T23:33:35.186439+00:00" }, "email": { "type": "string", "example": "teammate-x7ww@diditcapture.dev" }, "name": { "type": "string", "example": "teammate-x7ww@diditcapture.dev" }, "role": { "type": "string", "example": "reader" } } }, "example": { "capabilities": [], "created_at": "2026-07-02T23:51:58.759756+00:00", "email": "teammate-b2v9@diditcapture.dev", "name": "teammate-b2v9@diditcapture.dev", "role": "reader" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Invite a team member with a role.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "email": { "type": "string", "example": "teammate-x7ww@diditcapture.dev" }, "role": { "type": "string", "example": "reader" } } }, "example": { "email": "teammate-b2v9@diditcapture.dev", "role": "reader" } } } } } }, "/v1/members/{email}": { "patch": { "operationId": "v1_members_partial_update", "parameters": [ { "name": "email", "in": "path", "required": true, "description": "`email` path parameter.", "schema": { "type": "string" } } ], "tags": [ "Other" ], "responses": { "200": { "description": "No response body", "content": { "application/json": { "schema": { "type": "object", "properties": { "capabilities": { "type": "array", "items": { "type": "string", "example": "create:credential-schemas" } }, "created_at": { "type": "string", "example": "2026-07-02T23:33:35.186439+00:00" }, "email": { "type": "string", "example": "teammate-x7ww@diditcapture.dev" }, "name": { "type": "string", "example": "teammate-x7ww@diditcapture.dev" }, "role": { "type": "string", "example": "admin" } } }, "example": { "capabilities": [ "create:credential-schemas", "create:credential-templates", "create:credentials", "create:presentations", "create:relying-parties", "create:trust-frameworks", "create:trusted-issuers", "delete:credential-schemas", "delete:relying-parties", "delete:trust-frameworks", "delete:trusted-issuers", "write:credential-schemas", "write:credentials", "write:members", "write:signing-keys", "write:trust-frameworks", "write:trusted-issuers" ], "created_at": "2026-07-02T23:51:58.759756+00:00", "email": "teammate-b2v9@diditcapture.dev", "name": "teammate-b2v9@diditcapture.dev", "role": "admin" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Change a member's role.", "description": "Change a member's role.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "role": { "type": "string", "example": "admin" } } }, "example": { "role": "admin" } } } } }, "delete": { "operationId": "v1_members_destroy", "parameters": [ { "name": "email", "in": "path", "required": true, "description": "`email` path parameter.", "schema": { "type": "string" } } ], "tags": [ "Other" ], "responses": { "204": { "description": "No response body" } }, "security": [ { "bearerAuth": [] } ], "summary": "Remove a team member (204).", "description": "Remove a team member (204)." } }, "/v1/credential-schemas": { "get": { "operationId": "v1_credential_schemas_retrieve", "tags": [ "Credentials" ], "responses": { "200": { "description": "Array of credential schemas. Each array element contains these fields.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "attributes": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "given_name", "description": "Human-readable schema name." }, "sd": { "type": "boolean", "example": true, "description": "Whether the claim supports selective disclosure." } } }, "description": "Claim attributes that make up the credential." }, "branding": { "type": "object", "properties": {}, "description": "Wallet branding object returned with the schema. The captured examples are empty objects." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.328099Z", "description": "Timestamp when the schema was created.", "format": "date-time" }, "format": { "type": "string", "example": "sd_jwt_vc", "description": "Credential format. The captured value is `sd_jwt_vc`, the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format." }, "name": { "type": "string", "example": "Loyalty Membership", "description": "Human-readable schema name." }, "revocable": { "type": "boolean", "example": true, "description": "Whether issued credentials from this schema can be revoked." }, "status": { "type": "string", "example": "active", "description": "Lifecycle status of this schema version." }, "supersedes": { "type": [ "string", "null" ], "example": null, "description": "Schema UUID that this version supersedes. Null means this is the first version.", "format": "uuid" }, "uuid": { "type": "string", "example": "5e41f295-5b7b-456a-989d-582373595319", "description": "Unique identifier of the credential schema. You use it to fetch the schema or create templates.", "format": "uuid" }, "vct": { "type": "string", "example": "AirlineLoyalty", "description": "VCT (Verifiable Credential Type) value embedded in credentials issued from this schema." }, "version": { "type": "string", "example": "1.0", "description": "Schema version string." } } } }, "example": [ { "attributes": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:57.328099Z", "format": "sd_jwt_vc", "name": "Loyalty Membership", "revocable": true, "status": "active", "supersedes": null, "uuid": "5e41f295-5b7b-456a-989d-582373595319", "vct": "AirlineLoyalty", "version": "1.0" }, { "attributes": [ { "name": "member_id", "sd": true }, { "name": "level", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:56.327224Z", "format": "sd_jwt_vc", "name": "Membership Card", "revocable": true, "status": "active", "supersedes": null, "uuid": "55f10983-2c9f-405d-aa57-313e9572935c", "vct": "MembershipCard", "version": "1.0" }, { "attributes": [ { "name": "over_18", "sd": true }, { "name": "birth_year", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:56.326008Z", "format": "sd_jwt_vc", "name": "Age Credential", "revocable": true, "status": "active", "supersedes": null, "uuid": "d3dc98eb-b9c3-42d3-876f-af0252f27b50", "vct": "AgeOver18", "version": "1.0" }, { "attributes": [ { "name": "student_id", "sd": true }, { "name": "program", "sd": true }, { "name": "enrollment_year", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:56.325151Z", "format": "sd_jwt_vc", "name": "Student ID", "revocable": true, "status": "active", "supersedes": null, "uuid": "7160d273-3f4d-4211-ac95-b06193185a97", "vct": "StudentID", "version": "1.0" }, { "attributes": [ { "name": "employee_id", "sd": true }, { "name": "role", "sd": true }, { "name": "department", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:56.324396Z", "format": "sd_jwt_vc", "name": "Employee Badge", "revocable": true, "status": "active", "supersedes": null, "uuid": "60f8f2c1-612e-444c-8b0b-ba292a12b5a3", "vct": "EmployeeBadge", "version": "1.0" }, { "attributes": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true }, { "name": "frequent_flyer_number", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:56.323039Z", "format": "sd_jwt_vc", "name": "Airline Loyalty", "revocable": true, "status": "active", "supersedes": null, "uuid": "6f36cb43-719a-4741-84b9-b61395dbe392", "vct": "AirlineLoyalty", "version": "1.0" } ] } } } }, "summary": "List credential schemas", "description": "List credential schemas for your tenant. Each schema defines a VCT (Verifiable Credential Type), credential format, attributes, revocability, status, and version lineage. Use this before you create templates or issue credentials.", "security": [ { "bearerAuth": [] } ] }, "post": { "operationId": "v1_credential_schemas_create", "tags": [ "Credentials" ], "responses": { "201": { "description": "The credential schema was created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the credential schema.", "example": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable schema name.", "example": "Loyalty Membership" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value embedded in credentials issued from this schema.", "example": "AirlineLoyalty" }, "version": { "type": "string", "description": "Schema version string.", "example": "1.0" }, "format": { "type": "string", "description": "Credential format. The captured value is `sd_jwt_vc`, the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format.", "example": "sd_jwt_vc" }, "attributes": { "type": "array", "description": "Claim attributes stored on the schema.", "example": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name as it appears in the credential.", "example": "given_name" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } } } }, "branding": { "type": "object", "description": "Wallet branding object returned with the schema. The captured example is an empty object.", "example": {}, "properties": {} }, "revocable": { "type": "boolean", "description": "Whether issued credentials from this schema can be revoked.", "example": true }, "status": { "type": "string", "description": "Lifecycle status of this schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": null, "format": "uuid" }, "created_at": { "type": "string", "description": "Timestamp when the schema was created.", "example": "2026-07-02T23:33:33.468912Z", "format": "date-time" } } }, "example": { "attributes": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:57.328099Z", "format": "sd_jwt_vc", "name": "Loyalty Membership", "revocable": true, "status": "active", "supersedes": null, "uuid": "5e41f295-5b7b-456a-989d-582373595319", "vct": "AirlineLoyalty", "version": "1.0" } } } } }, "summary": "Create a credential schema", "description": "Create a credential schema for your tenant. You define the schema name, VCT (Verifiable Credential Type), and claim attributes. The API returns the stored schema with defaults such as format, version, branding, revocability, and status.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "Human-readable schema name.", "example": "Loyalty Membership" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value to embed in issued credentials.", "example": "AirlineLoyalty" }, "attributes": { "type": "array", "description": "Claim attributes to include in credentials issued from this schema.", "example": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name to include in the credential.", "example": "given_name" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } }, "required": [ "name", "sd" ] } } }, "required": [ "name", "vct", "attributes" ] }, "example": { "attributes": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "name": "Loyalty Membership", "vct": "AirlineLoyalty" } } } } } }, "/v1/credential-templates": { "get": { "operationId": "v1_credential_templates_retrieve", "tags": [ "Credentials" ], "responses": { "200": { "description": "Array of credential templates. Each array element contains these fields.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "created_at": { "type": "string", "example": "2026-07-02T23:51:57.339031Z", "description": "Timestamp when the template was created.", "format": "date-time" }, "name": { "type": "string", "example": "standard", "description": "Human-readable template name." }, "schema": { "type": "string", "example": "5e41f295-5b7b-456a-989d-582373595319", "description": "UUID of the schema bound to this template.", "format": "uuid" }, "uuid": { "type": "string", "example": "b18c99cb-5b7b-4915-938c-038c2ddefb6f", "description": "Unique identifier of the credential template.", "format": "uuid" }, "validity_seconds": { "type": "integer", "example": 31536000, "description": "Credential validity duration, in seconds, applied during issuance." } } } }, "example": [ { "created_at": "2026-07-02T23:51:57.339031Z", "name": "standard", "schema": "5e41f295-5b7b-456a-989d-582373595319", "uuid": "b18c99cb-5b7b-4915-938c-038c2ddefb6f", "validity_seconds": 31536000 }, { "created_at": "2026-07-02T23:51:56.327605Z", "name": "Membership Card (default)", "schema": "55f10983-2c9f-405d-aa57-313e9572935c", "uuid": "52daca56-2241-43d9-9960-9af2c40b1ece", "validity_seconds": 31536000 }, { "created_at": "2026-07-02T23:51:56.326881Z", "name": "Age Credential (default)", "schema": "d3dc98eb-b9c3-42d3-876f-af0252f27b50", "uuid": "8aab4ece-cc38-4bb1-901d-414d6530d42d", "validity_seconds": 31536000 }, { "created_at": "2026-07-02T23:51:56.325673Z", "name": "Student ID (default)", "schema": "7160d273-3f4d-4211-ac95-b06193185a97", "uuid": "528cd9cc-54e4-4e49-97a8-a940d225bd7a", "validity_seconds": 31536000 }, { "created_at": "2026-07-02T23:51:56.324826Z", "name": "Employee Badge (default)", "schema": "60f8f2c1-612e-444c-8b0b-ba292a12b5a3", "uuid": "519ac101-fbd6-49a4-955d-614c0cdfa9e5", "validity_seconds": 31536000 }, { "created_at": "2026-07-02T23:51:56.323867Z", "name": "Airline Loyalty (default)", "schema": "6f36cb43-719a-4741-84b9-b61395dbe392", "uuid": "c52b81d8-adc7-4991-9920-b8a1fded038c", "validity_seconds": 31536000 } ] } } } }, "summary": "List credential templates", "description": "List credential templates for your tenant. A template binds a schema to an issuance profile. Use a template UUID when you issue a credential.", "security": [ { "bearerAuth": [] } ] }, "post": { "operationId": "v1_credential_templates_create", "tags": [ "Credentials" ], "responses": { "201": { "description": "The credential template was created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the credential template.", "example": "5588f83f-620b-4614-8ffa-933634a0b708", "format": "uuid" }, "schema": { "type": "string", "description": "UUID of the schema bound to this template.", "example": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable template name.", "example": "standard" }, "validity_seconds": { "type": "integer", "description": "Credential validity duration, in seconds, applied during issuance.", "example": 31536000 }, "created_at": { "type": "string", "description": "Timestamp when the template was created.", "example": "2026-07-02T23:33:33.479128Z", "format": "date-time" } } }, "example": { "created_at": "2026-07-02T23:51:57.339031Z", "name": "standard", "schema": "5e41f295-5b7b-456a-989d-582373595319", "uuid": "b18c99cb-5b7b-4915-938c-038c2ddefb6f", "validity_seconds": 31536000 } } } } }, "summary": "Create a credential template", "description": "Create an issuance template for a credential schema. You provide the schema UUID, template name, and validity duration. Use the returned template UUID when you issue credentials.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "schema": { "type": "string", "description": "UUID of the schema to bind to this template.", "example": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable template name.", "example": "standard" }, "validity_seconds": { "type": "integer", "description": "Credential validity duration, in seconds, applied during issuance.", "example": 31536000 } }, "required": [ "schema", "name" ] }, "example": { "name": "standard", "schema": "5e41f295-5b7b-456a-989d-582373595319", "validity_seconds": 31536000 } } } } } }, "/v1/credentials/issue": { "post": { "operationId": "v1_credentials_issue_create", "tags": [ "Credentials" ], "responses": { "201": { "description": "The credential was issued.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential_id": { "type": "string", "description": "Unique identifier of the issued credential.", "example": "6585d444-c19b-40e8-a64a-3e24a838214c", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value of the issued credential.", "example": "AirlineLoyalty" }, "sd_jwt": { "type": "string", "description": "Serialized SD-JWT VC (Selective-Disclosure JWT Verifiable Credential). The captured value was redacted.", "example": "" }, "status_idx": { "type": "integer", "description": "Status-list index assigned to the issued credential.", "example": 34 } } }, "example": { "credential_id": "c9d0940f-d03f-4c1d-8132-278c2c3016f4", "sd_jwt": "", "status_idx": 34, "vct": "AirlineLoyalty" } } } } }, "summary": "Issue a credential directly (management)", "description": "Issue an SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) to a holder. You provide a template UUID, the holder public JWK (JSON Web Key), and claim values. The API returns the issued credential identifier and serialized credential.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "template_id": { "type": "string", "description": "UUID of the credential template to issue from.", "example": "5588f83f-620b-4614-8ffa-933634a0b708", "format": "uuid" }, "holder_jwk": { "type": "object", "description": "Holder public key as a JWK (JSON Web Key). The credential is bound to this key.", "example": { "crv": "P-256", "kty": "EC", "x": "Y9feBRecVo4n0vrl8iFCTuaC9y3XMEZd3pxaE-yMdW4", "y": "YP8zky5B1mzZO2zHX2aSAemQKh4Tx6WMVclUj1W7S2Q" }, "properties": { "kty": { "type": "string", "description": "JWK (JSON Web Key) key type.", "example": "EC" }, "crv": { "type": "string", "description": "Elliptic curve name in the JWK (JSON Web Key).", "example": "P-256" }, "x": { "type": "string", "description": "X coordinate of the public key.", "example": "Y9feBRecVo4n0vrl8iFCTuaC9y3XMEZd3pxaE-yMdW4" }, "y": { "type": "string", "description": "Y coordinate of the public key.", "example": "YP8zky5B1mzZO2zHX2aSAemQKh4Tx6WMVclUj1W7S2Q" } } }, "claims": { "type": "object", "description": "Credential claim values keyed by schema attribute name.", "example": { "given_name": "Ada", "tier": "gold" }, "properties": { "given_name": { "type": "string", "description": "Claim value for the holder's given name.", "example": "Ada" }, "tier": { "type": "string", "description": "Claim value for the holder's membership tier.", "example": "gold" } } } }, "required": [ "template_id", "holder_jwk", "claims" ] }, "example": { "claims": { "given_name": "Ada", "tier": "gold" }, "holder_jwk": { "crv": "P-256", "kty": "EC", "x": "Y5JQ00Kvn2iW7tc5OuwTHlxyPYrxWdmbFtpR5oeXDtk", "y": "DSUZdwoe8qqxMYuNRt2uzUftY0-Aaq1tlx4ER-pPOZ4" }, "template_id": "b18c99cb-5b7b-4915-938c-038c2ddefb6f" } } } } } }, "/v1/credentials": { "get": { "operationId": "v1_credentials_retrieve", "tags": [ "Credentials" ], "responses": { "200": { "description": "Array of issued credential records. Each array element contains these fields.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "expires_at": { "type": "string", "example": "2027-07-02T23:51:57.346460Z", "description": "Timestamp when the credential expires.", "format": "date-time" }, "holder_cnf": { "type": "object", "properties": { "crv": { "type": "string", "example": "P-256", "description": "Elliptic curve name in the JWK (JSON Web Key)." }, "kty": { "type": "string", "example": "EC", "description": "JWK (JSON Web Key) key type." }, "x": { "type": "string", "example": "Y5JQ00Kvn2iW7tc5OuwTHlxyPYrxWdmbFtpR5oeXDtk", "description": "X coordinate of the key." }, "y": { "type": "string", "example": "DSUZdwoe8qqxMYuNRt2uzUftY0-Aaq1tlx4ER-pPOZ4", "description": "Y coordinate of the key." } }, "description": "Holder confirmation key as a JWK (JSON Web Key) object. Some captured list records include private key material." }, "iss": { "type": "string", "example": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "description": "Issuer URL that issued the credential.", "format": "uri" }, "issued_at": { "type": "string", "example": "2026-07-02T23:51:57.346854Z", "description": "Timestamp when the credential was issued.", "format": "date-time" }, "source_session_id": { "type": "string", "example": "", "description": "Source Didit verification session identifier. The captured records use an empty string when no source session is linked." }, "status": { "type": "string", "example": "issued", "description": "Lifecycle status of the credential." }, "status_idx": { "type": "integer", "example": 34, "description": "Status-list index assigned to the credential." }, "uuid": { "type": "string", "example": "c9d0940f-d03f-4c1d-8132-278c2c3016f4", "description": "Unique identifier of the issued credential.", "format": "uuid" }, "vct": { "type": "string", "example": "AirlineLoyalty", "description": "VCT (Verifiable Credential Type) value of the issued credential." } } } }, "example": [ { "expires_at": "2027-07-02T23:51:57.346460Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "Y5JQ00Kvn2iW7tc5OuwTHlxyPYrxWdmbFtpR5oeXDtk", "y": "DSUZdwoe8qqxMYuNRt2uzUftY0-Aaq1tlx4ER-pPOZ4" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:57.346854Z", "source_session_id": "", "status": "issued", "status_idx": 34, "uuid": "c9d0940f-d03f-4c1d-8132-278c2c3016f4", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.412973Z", "holder_cnf": { "crv": "P-256", "d": "ENlSO38cEfdyQFO5t6ohMrU2KjOlqM0L-u6IBg1JLuI", "kty": "EC", "x": "tVtAhPwoYfTTYOrPZieW9uqquapGzCtz9paliT5EnMA", "y": "WLQmScYlBR2nt2PVyLI6On0PM80tfSPmP5nt-2Namh0" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.413208Z", "source_session_id": "", "status": "issued", "status_idx": 33, "uuid": "bc5fec61-a6af-40a8-9ba3-f87ef58247c1", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.407712Z", "holder_cnf": { "crv": "P-256", "d": "Mf17_9vkQDzUIo95V5xmXdIRJZ452LFB5A0M_hbzEUE", "kty": "EC", "x": "cnCIzcBwWAUdC1Ngz2TC4lESr19cUxxcsysxeVm1hss", "y": "ytLNO3uv9DNB6BsenEo31zvasBIDZdwvgrx7jevI4kk" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.407950Z", "source_session_id": "", "status": "issued", "status_idx": 32, "uuid": "281d97b0-0d32-48f8-bc40-94fd4fc91c2f", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.400717Z", "holder_cnf": { "crv": "P-256", "d": "ycSkjqdvB1OgoREdBdKdqi9HClLsKa9Kbn92GKJwmP0", "kty": "EC", "x": "sgnhLnLQ8EtlUoicGPeXrKxpJdUCrSiVjmWShPprPsg", "y": "NsIyzO54S4PYgyxwW8JibEnJJFovYRV3wdwxEwMbVxE" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.401017Z", "source_session_id": "", "status": "issued", "status_idx": 31, "uuid": "a90c3075-0707-44d1-a8b1-f945011f61e1", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.394271Z", "holder_cnf": { "crv": "P-256", "d": "W-CHd5qrybndC6tQrU1qGzHBjI1U2Rxq4ZKzXmAsvTg", "kty": "EC", "x": "E991_b4wvCMY-TmpFugbobKCb_1g1pkdQCXCM9Fzohk", "y": "IN4oQD0kqumcAmEKEKYnOpEetAYeNjZGcfVpB6ZhjKQ" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.394508Z", "source_session_id": "", "status": "issued", "status_idx": 30, "uuid": "84be4953-06da-463f-a842-2abf1f250145", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.391452Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "7j6KD7cZM8dfigvnJKIUro9FyCQMrUFi75iVbqrNWxw", "y": "5Dw9W1OE5AIDuMWd3esXhrvwdwC_fTIJRiQ3Cc2qnuc" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.391680Z", "source_session_id": "", "status": "issued", "status_idx": 29, "uuid": "0a032bd8-f135-4bc3-b779-4ce62e3d143c", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.389013Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "96qW4Ug_awNAAyCoJ9PbTU70C0sV-0bzz-u-n90rI-g", "y": "z8pm98q3juT38IKGqtFrUGpXDAAnLa4q2ZlytdAyZoU" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.389235Z", "source_session_id": "", "status": "revoked", "status_idx": 28, "uuid": "e28e2eb5-3557-40ce-8fb6-a20319274f4f", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.386722Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "lYpMRwcj5_WnhXpQtG-pLL6pjmq4HWsW5Q2RjgwFvog", "y": "PB5hqpO6K4KqfyUJflcFWizp_QFPYHFtmb8pB41yugU" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.386940Z", "source_session_id": "", "status": "suspended", "status_idx": 27, "uuid": "0ab8a7fe-5a46-4511-b64e-c658ce034b6d", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.384834Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "0jlUAfELStZNeEjcTKYR4WmvXUUSIbfjL9hl0rJQRig", "y": "pP0JgpxPfPosPrwMnu2KSYIjUEkOoKcsM5mBCVWZ4lk" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.385065Z", "source_session_id": "", "status": "issued", "status_idx": 26, "uuid": "b497b4d1-aab9-4c27-b750-d305320a3018", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.383309Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "u8YRVKTTIEgp3GY2oYWu9rqAfpBgIDyzRxFsFRUOOXQ", "y": "mOyRgh4a-msxJX3ijB7-q-lxu0K3xnHyVtBWpJHFpho" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.383556Z", "source_session_id": "", "status": "issued", "status_idx": 25, "uuid": "7263b3aa-0cbe-43d5-8e54-5e2616a77273", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.381399Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "PgcUfi4UvdZfKcnwM6viMHAq0C7QkIByaTWV4Pj1Bzo", "y": "TxtsQrTVoMSdn7wAElCTSJKNTsyJW5znSao8TxmT9Ok" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.381649Z", "source_session_id": "", "status": "issued", "status_idx": 24, "uuid": "d0428efc-f1f0-4fa7-b802-9e1755eaa9d9", "vct": "MembershipCard" }, { "expires_at": "2027-07-02T23:51:56.379515Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "8aOMbrPz1x98kuBmlOx2i2gZU9I-4V9GRNJ0mOdNtHI", "y": "96x8qBoLG1PRurr_UVQMySr2X-27uSR6TJFkG_Hr6sI" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.379743Z", "source_session_id": "", "status": "issued", "status_idx": 23, "uuid": "0de85f52-15ca-4a12-a73e-c30bcb7435cc", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.377121Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "TIAakWswhOp8piYl3-UG13_XrBjO_5c5iKv_XeYI-Wk", "y": "lRu2mqZoGmQDA6_P5-opFjTIJEJ8OtRvSAwRwIHc04o" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.377344Z", "source_session_id": "", "status": "revoked", "status_idx": 22, "uuid": "4fa09efc-f02d-4c17-9d99-e273720fb22d", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.374805Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "4DDsUiszMAHBgLMH5fAzh73SZ0jLzJaa2KJKmlM0r3Y", "y": "18Y_RoK5Ck7WaAiIYFjy0qptaEeAPmZhw8G34_4ZdmY" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.375047Z", "source_session_id": "", "status": "suspended", "status_idx": 21, "uuid": "0ae13db0-a67d-4044-98aa-5a9bf0088d96", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.372827Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "3DxOI47KyvwBZ55X4E6UQ0SdU0-67iXhfBt9ACBb7Xk", "y": "CyHqEAKa7LBRIhjrFfWIyTbodUT5XTgF3ZbBRNq_4AY" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.373049Z", "source_session_id": "", "status": "issued", "status_idx": 20, "uuid": "6cca70a3-6a2d-4f92-a2ef-789e4db8eba5", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.371206Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "B1FZD2xKedc78OhuchVvO7wutWZ8SbC1k2dBedQ7fI0", "y": "YGOhjbmSWNrx6YWLrXOVoXTZrBApXz5h3Hz0JBQhFXg" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.371451Z", "source_session_id": "", "status": "issued", "status_idx": 19, "uuid": "41d05f4b-b365-44df-87ce-362082340326", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.369524Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "DNMhpiTqbXUKieAJFAssCB24JQxxVxgSBxwiZDb1wik", "y": "Af-wONFtVI4CuoNHS83Ths0nwp65V7AmjjPsURAu4yY" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.369760Z", "source_session_id": "", "status": "issued", "status_idx": 18, "uuid": "f3ee7cd5-d436-4cbf-a045-cdb242ee97d4", "vct": "AgeOver18" }, { "expires_at": "2027-07-02T23:51:56.367946Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "AjBKCh1Ms-s8P2oqvhR1qXoYIMUfsTT2uvZOk1ocCww", "y": "rnLY4P0mQCiYbmXTalTeY4GlhfJCDHexa3xYFqqSczU" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.368205Z", "source_session_id": "", "status": "issued", "status_idx": 17, "uuid": "fd4acd27-74f6-411c-ae4a-581967531edc", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.364932Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "OSfjkR4D8CQD469Gn2L5ZyfzFTFxAnrkpRNWKTmi50k", "y": "xFKlaS0kmzycWs7-i5SPhnNBWbZ130y869ARBy7vdxw" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.365166Z", "source_session_id": "", "status": "revoked", "status_idx": 16, "uuid": "c4dbe3ec-2ccb-4503-8309-5760968e0f3e", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.362661Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "9nQ6Gtk_bwS2Hg1_7MGVO86u188ZsogH-MLffroewtQ", "y": "cUwTZz5o-1xMJCGMDrYIXF_X996lfYCEVJsDen2y6jc" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.362900Z", "source_session_id": "", "status": "suspended", "status_idx": 15, "uuid": "121b8a48-b809-4653-bfe3-2604a6276f39", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.361038Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "nXvl6KMzRPkZigt1Un5NSzsYdu8t8Tv7rwyKLaAvddU", "y": "3sI_BkekPv4DDKG-m2c9-oWxbKVLY-XMYTpFHjP_iNE" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.361272Z", "source_session_id": "", "status": "issued", "status_idx": 14, "uuid": "47aa0795-4504-49e7-b605-a4b112956502", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.359426Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "M0vGXczfcclGptq5NruqFqDopJFhf86lEtqnYwIHwW0", "y": "Z82aWGBYw3-ZuE91_rhe-9H3leuGXBBXETcp20ClhWw" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.359674Z", "source_session_id": "", "status": "issued", "status_idx": 13, "uuid": "d55f5841-7046-46cf-9edc-b5c34b68c0b1", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.357334Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "jVo9MeiqY8nvWOWSnozAGMeAnk3EGFz1wEMopgau2vA", "y": "1XkwV8_bUJp41SvY8xjMDZ3Jv1hyMxCDMo9KxU5b_h4" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.357593Z", "source_session_id": "", "status": "issued", "status_idx": 12, "uuid": "4720f6ba-550c-4015-8a41-3f7d5fd3112c", "vct": "StudentID" }, { "expires_at": "2027-07-02T23:51:56.355408Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "90FerQuzkRaqXKoWvyh-6Ss5lxAz6n4Nq8wD_Paa6J0", "y": "44k-WW47kUJj6sPDGKsFrWXa0LXiMRmCEjzLJyPLlVM" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.355686Z", "source_session_id": "", "status": "issued", "status_idx": 11, "uuid": "f0c722eb-bc4c-4ac8-99ce-c8c72ec43614", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.352610Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "XOOkcdf5HNHdPoRK3KpRSN0B5HOkrDs4enxgXSwy0rk", "y": "Huq31uvxhjpSV5z7qjZe_U7abB4B3_1j6gfDwaFBeDw" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.352860Z", "source_session_id": "", "status": "revoked", "status_idx": 10, "uuid": "5bbdc722-121b-4d58-9a40-ea9b3c291a25", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.350128Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "k1mQ2HAOWMy4XNCGpcz4Gvr5XH_4Wow3nQkLggka_o8", "y": "-g6DuS0SSsDCfZ2wj-tobC-yMQi1I0PeG3HbZDYVdIM" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.350388Z", "source_session_id": "", "status": "suspended", "status_idx": 9, "uuid": "8914fe70-22c6-4851-b951-8bdfc3a53ef2", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.347810Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "pIIhmoh6Cj59ACP2iaqjEIYJwZfZ2D5hBQaOmwSJxz8", "y": "7tyTAWVZlIG-ubAYGmh00gWclorMKlnEW2EqwXVF6tY" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.348061Z", "source_session_id": "", "status": "issued", "status_idx": 8, "uuid": "e9643186-f80e-46de-a480-63d5478c2152", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.345830Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "zqNJ4kS_U6XaQGndcb6FGq5hG2UwNYzmoZQcejU7Woc", "y": "Xcx0vDe0ic4qpfI3xkht3Fi16JN8OjjUBC9IExMo9wE" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.346142Z", "source_session_id": "", "status": "issued", "status_idx": 7, "uuid": "27a5abff-d03e-4c72-85a2-40188262d536", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.344066Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "tNfHnbniRMLB95gqr1wyIiLqZRH03jaJcnE4a6my4T8", "y": "60vfDgvXnNlkak1rFmdT3KOEYhlGv7bbw0_1SbtlhBA" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.344334Z", "source_session_id": "", "status": "issued", "status_idx": 6, "uuid": "6c830333-a5cb-46a2-a8da-b4ecdc4ee511", "vct": "EmployeeBadge" }, { "expires_at": "2027-07-02T23:51:56.342390Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "RTgGXWqNJIzyhBJ85jYm0Et0APmDONrG6xYzJCevIY0", "y": "C-UMQXjJ6gVQt3dhmhemuZ3fIhMScyBN29vm57_Z-yU" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.342663Z", "source_session_id": "", "status": "issued", "status_idx": 5, "uuid": "d2324c7f-54cb-410d-bbc7-059ac3194630", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.339515Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "wv_LQ_7IsSw5xcIN0Vf3SBG123obet3JB5BrYIEkY8E", "y": "KcRn3qXdxaMhd4Ix8SiSRYj9aAu1Ya5LGZJRTH8Owgg" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.339827Z", "source_session_id": "", "status": "revoked", "status_idx": 4, "uuid": "aaf88bb7-9f31-4a71-b234-d6784f76946b", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.336786Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "B81LI7BNFoQxItvDzXwyB-UeAkk1oIWAOlJzRd5dkjw", "y": "i8A1geRP0saz6BjJYAEDbtsFhsLVRw1EA-5re5WoPZ8" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.337102Z", "source_session_id": "", "status": "suspended", "status_idx": 3, "uuid": "059ba77f-f91c-4055-9e05-f56f0cdd4046", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.334816Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "uN2B04oV7TZrf4-hnulsua-AqguL3GsYVaqRyWSKQy4", "y": "L9XQEq2buD3pwYtjDXg4HrHY66e_l6nhUAB1_cYmGhU" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.335125Z", "source_session_id": "", "status": "issued", "status_idx": 2, "uuid": "5e9dcd0b-6c9f-4f26-91bd-ad180e2bc688", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.332646Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "3DM7sLP-WXWnuXTwCKg7IwcPA0nAJqXuovVftRNcVGg", "y": "KZE9ItERjWmwHR-G5UGF36JN9MsyErdPhHjyfEtTJd0" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.332949Z", "source_session_id": "", "status": "issued", "status_idx": 1, "uuid": "53cc888e-aa7f-4f9b-a500-bbdfe100fa87", "vct": "AirlineLoyalty" }, { "expires_at": "2027-07-02T23:51:56.330297Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "qJC6-CbzqacJadgLEcbbljHhPxqpj-a8k6TuuJ7lXs8", "y": "sFVnTP8hsjCIa-Zkqqet6geRsvCE4V7HNPUyhmlwisE" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:56.330669Z", "source_session_id": "", "status": "issued", "status_idx": 0, "uuid": "7d25f6e2-2602-4b5d-863c-b29329dac023", "vct": "AirlineLoyalty" } ] } } }, "401": { "description": "Unauthorized \u2014 a valid tenant API key (Bearer) was not supplied. (Example: missing bearer token.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Error detail returned by the API.", "example": "Authentication credentials were not provided." } } }, "example": { "detail": "Authentication credentials were not provided." } } } } }, "summary": "List issued credentials", "description": "List issued credentials for your tenant. Each credential includes lifecycle status, issuer, validity timestamps, holder confirmation key, and source session information. Use this to manage issued credentials after issuance.", "security": [ { "bearerAuth": [] } ] } }, "/v1/credentials/{uuid}": { "get": { "operationId": "v1_credentials_retrieve_2", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the issued credential to fetch.", "schema": { "type": "string" } } ], "tags": [ "Credentials" ], "responses": { "200": { "description": "Issued credential management record.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the issued credential.", "example": "6585d444-c19b-40e8-a64a-3e24a838214c", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value of the issued credential.", "example": "AirlineLoyalty" }, "iss": { "type": "string", "description": "Issuer URL that issued the credential.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "status": { "type": "string", "description": "Lifecycle status of the credential.", "example": "issued" }, "status_idx": { "type": "integer", "description": "Status-list index assigned to the credential.", "example": 34 }, "issued_at": { "type": "string", "description": "Timestamp when the credential was issued.", "example": "2026-07-02T23:33:33.487031Z", "format": "date-time" }, "expires_at": { "type": "string", "description": "Timestamp when the credential expires.", "example": "2027-07-02T23:33:33.486639Z", "format": "date-time" }, "holder_cnf": { "type": "object", "description": "Holder confirmation key as a JWK (JSON Web Key) object.", "example": { "crv": "P-256", "kty": "EC", "x": "Y9feBRecVo4n0vrl8iFCTuaC9y3XMEZd3pxaE-yMdW4", "y": "YP8zky5B1mzZO2zHX2aSAemQKh4Tx6WMVclUj1W7S2Q" }, "properties": { "kty": { "type": "string", "description": "JWK (JSON Web Key) key type.", "example": "EC" }, "crv": { "type": "string", "description": "Elliptic curve name in the JWK (JSON Web Key).", "example": "P-256" }, "x": { "type": "string", "description": "X coordinate of the key.", "example": "Y9feBRecVo4n0vrl8iFCTuaC9y3XMEZd3pxaE-yMdW4" }, "y": { "type": "string", "description": "Y coordinate of the key.", "example": "YP8zky5B1mzZO2zHX2aSAemQKh4Tx6WMVclUj1W7S2Q" } } }, "source_session_id": { "type": "string", "description": "Source Didit verification session identifier. The captured record uses an empty string when no source session is linked.", "example": "" } } }, "example": { "expires_at": "2027-07-02T23:51:57.346460Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "Y5JQ00Kvn2iW7tc5OuwTHlxyPYrxWdmbFtpR5oeXDtk", "y": "DSUZdwoe8qqxMYuNRt2uzUftY0-Aaq1tlx4ER-pPOZ4" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:57.346854Z", "source_session_id": "", "status": "issued", "status_idx": 34, "uuid": "c9d0940f-d03f-4c1d-8132-278c2c3016f4", "vct": "AirlineLoyalty" } } } }, "404": { "description": "Not found \u2014 no such resource for this tenant (cross-tenant reads return 404, not 403). (Example: unknown credential id.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Error detail returned by the API.", "example": "No IssuedCredential matches the given query." } } }, "example": { "detail": "No IssuedCredential matches the given query." } } } } }, "summary": "Get an issued credential", "description": "Fetch one issued credential management record. Use this to check lifecycle status, issuer, validity timestamps, holder confirmation key, and source session information.", "security": [ { "bearerAuth": [] } ] } }, "/v1/credentials/{uuid}/revoke": { "post": { "operationId": "v1_credentials_revoke_create", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the issued credential to revoke.", "schema": { "type": "string" } } ], "tags": [ "Credentials" ], "responses": { "200": { "description": "The credential was revoked.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the issued credential.", "example": "227e2acd-2d34-407a-8583-9b3fe2f71c61", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value of the issued credential.", "example": "AirlineLoyalty" }, "iss": { "type": "string", "description": "Issuer URL that issued the credential.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "status": { "type": "string", "description": "Lifecycle status after the call.", "example": "revoked" }, "status_idx": { "type": "integer", "description": "Status-list index assigned to the credential.", "example": 36 }, "issued_at": { "type": "string", "description": "Timestamp when the credential was issued.", "example": "2026-07-02T23:33:33.604754Z", "format": "date-time" }, "expires_at": { "type": "string", "description": "Timestamp when the credential expires.", "example": "2027-07-02T23:33:33.604455Z", "format": "date-time" }, "holder_cnf": { "type": "object", "description": "Holder confirmation key as a JWK (JSON Web Key) object.", "example": { "crv": "P-256", "kty": "EC", "x": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0", "y": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" }, "properties": { "kty": { "type": "string", "description": "JWK (JSON Web Key) key type.", "example": "EC" }, "crv": { "type": "string", "description": "Elliptic curve name in the JWK (JSON Web Key).", "example": "P-256" }, "x": { "type": "string", "description": "X coordinate of the key.", "example": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0" }, "y": { "type": "string", "description": "Y coordinate of the key.", "example": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" } } }, "source_session_id": { "type": "string", "description": "Source Didit verification session identifier. The captured record uses an empty string when no source session is linked.", "example": "" } } }, "example": { "expires_at": "2027-07-02T23:51:57.468035Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "dn5TeSJBDFzSmO0lDn_SMbWaHliRw5ltXBpICoYQYMo", "y": "EeAIC7ebbfCVYRn6g7PGgdh8ShlFKYCBpX3AgmppF4w" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:57.468376Z", "source_session_id": "", "status": "revoked", "status_idx": 36, "uuid": "7bae29ed-12c0-49fd-8f3f-2f1b395747a7", "vct": "AirlineLoyalty" } } } }, "409": { "description": "Conflict \u2014 the requested lifecycle transition is not allowed from the current state. (Example: re-revoking a revoked credential.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Error detail returned by the API.", "example": "Cannot revoke a credential in status 'revoked'." } } }, "example": { "detail": "Cannot revoke a credential in status 'revoked'." } } } } }, "summary": "Revoke a credential", "description": "Permanently revoke an issued credential. Revocation is terminal for the captured lifecycle. The response returns the updated credential record.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/credentials/{uuid}/suspend": { "post": { "operationId": "v1_credentials_suspend_create", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the issued credential to suspend.", "schema": { "type": "string" } } ], "tags": [ "Credentials" ], "responses": { "200": { "description": "The credential was suspended.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the issued credential.", "example": "227e2acd-2d34-407a-8583-9b3fe2f71c61", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value of the issued credential.", "example": "AirlineLoyalty" }, "iss": { "type": "string", "description": "Issuer URL that issued the credential.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "status": { "type": "string", "description": "Lifecycle status after the call.", "example": "suspended" }, "status_idx": { "type": "integer", "description": "Status-list index assigned to the credential.", "example": 36 }, "issued_at": { "type": "string", "description": "Timestamp when the credential was issued.", "example": "2026-07-02T23:33:33.604754Z", "format": "date-time" }, "expires_at": { "type": "string", "description": "Timestamp when the credential expires.", "example": "2027-07-02T23:33:33.604455Z", "format": "date-time" }, "holder_cnf": { "type": "object", "description": "Holder confirmation key as a JWK (JSON Web Key) object.", "example": { "crv": "P-256", "kty": "EC", "x": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0", "y": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" }, "properties": { "kty": { "type": "string", "description": "JWK (JSON Web Key) key type.", "example": "EC" }, "crv": { "type": "string", "description": "Elliptic curve name in the JWK (JSON Web Key).", "example": "P-256" }, "x": { "type": "string", "description": "X coordinate of the key.", "example": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0" }, "y": { "type": "string", "description": "Y coordinate of the key.", "example": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" } } }, "source_session_id": { "type": "string", "description": "Source Didit verification session identifier. The captured record uses an empty string when no source session is linked.", "example": "" } } }, "example": { "expires_at": "2027-07-02T23:51:57.468035Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "dn5TeSJBDFzSmO0lDn_SMbWaHliRw5ltXBpICoYQYMo", "y": "EeAIC7ebbfCVYRn6g7PGgdh8ShlFKYCBpX3AgmppF4w" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:57.468376Z", "source_session_id": "", "status": "suspended", "status_idx": 36, "uuid": "7bae29ed-12c0-49fd-8f3f-2f1b395747a7", "vct": "AirlineLoyalty" } } } }, "409": { "description": "Conflict \u2014 the requested lifecycle transition is not allowed from the current state. (Example: already suspended (only issued -> suspended).)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Error detail returned by the API.", "example": "Cannot suspend a credential in status 'suspended'." } } }, "example": { "detail": "Cannot suspend a credential in status 'suspended'." } } } } }, "summary": "Suspend a credential", "description": "Temporarily suspend an issued credential. Suspension disables the credential until you reactivate it. The response returns the updated credential record.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/credentials/{uuid}/reactivate": { "post": { "operationId": "v1_credentials_reactivate_create", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the issued credential to reactivate.", "schema": { "type": "string" } } ], "tags": [ "Credentials" ], "responses": { "200": { "description": "The credential was reactivated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the issued credential.", "example": "227e2acd-2d34-407a-8583-9b3fe2f71c61", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value of the issued credential.", "example": "AirlineLoyalty" }, "iss": { "type": "string", "description": "Issuer URL that issued the credential.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "status": { "type": "string", "description": "Lifecycle status after the call.", "example": "issued" }, "status_idx": { "type": "integer", "description": "Status-list index assigned to the credential.", "example": 36 }, "issued_at": { "type": "string", "description": "Timestamp when the credential was issued.", "example": "2026-07-02T23:33:33.604754Z", "format": "date-time" }, "expires_at": { "type": "string", "description": "Timestamp when the credential expires.", "example": "2027-07-02T23:33:33.604455Z", "format": "date-time" }, "holder_cnf": { "type": "object", "description": "Holder confirmation key as a JWK (JSON Web Key) object.", "example": { "crv": "P-256", "kty": "EC", "x": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0", "y": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" }, "properties": { "kty": { "type": "string", "description": "JWK (JSON Web Key) key type.", "example": "EC" }, "crv": { "type": "string", "description": "Elliptic curve name in the JWK (JSON Web Key).", "example": "P-256" }, "x": { "type": "string", "description": "X coordinate of the key.", "example": "IH7dt6boywBE90Bl9MkN2Gu4PkSmX4EyA73B-eo51j0" }, "y": { "type": "string", "description": "Y coordinate of the key.", "example": "hJbByecLuaOCmC02m5kx_Y1DuK23tkMBRJolu1f-3EI" } } }, "source_session_id": { "type": "string", "description": "Source Didit verification session identifier. The captured record uses an empty string when no source session is linked.", "example": "" } } }, "example": { "expires_at": "2027-07-02T23:51:57.468035Z", "holder_cnf": { "crv": "P-256", "kty": "EC", "x": "dn5TeSJBDFzSmO0lDn_SMbWaHliRw5ltXBpICoYQYMo", "y": "EeAIC7ebbfCVYRn6g7PGgdh8ShlFKYCBpX3AgmppF4w" }, "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "issued_at": "2026-07-02T23:51:57.468376Z", "source_session_id": "", "status": "issued", "status_idx": 36, "uuid": "7bae29ed-12c0-49fd-8f3f-2f1b395747a7", "vct": "AirlineLoyalty" } } } }, "409": { "description": "Conflict \u2014 the requested lifecycle transition is not allowed from the current state. (Example: reactivating an already-issued credential.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Error detail returned by the API.", "example": "Cannot reactivate a credential in status 'issued'." } } }, "example": { "detail": "Cannot reactivate a credential in status 'issued'." } } } } }, "summary": "Reactivate a credential", "description": "Reactivate a suspended credential. The response returns the credential with lifecycle status set back to issued. Use this after suspension, not after revocation.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/presentations/request": { "get": { "operationId": "v1_presentations_request_retrieve", "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns a bare JSON array. Each array element is one presentation request.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "aud": { "type": "string", "example": "checkin-rp", "description": "Identifies the verifier audience for the presentation." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.366681Z", "description": "Records when the presentation request was created.", "format": "date-time" }, "dcql": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "type": "object", "properties": { "claims": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "string", "example": "tier" }, "description": "Identifies the requested claim path." } } }, "description": "Lists the claim paths the verifier asks the holder to disclose." }, "format": { "type": "string", "example": "dc+sd-jwt", "description": "Names the credential format requested by this query." }, "id": { "type": "string", "example": "cred1", "description": "Identifies the credential query inside the DCQL (Digital Credentials Query Language) payload." }, "meta": { "type": "object", "properties": { "vct_values": { "type": "array", "items": { "type": "string", "example": "AirlineLoyalty" }, "description": "Lists accepted VCT (Verifiable Credential Type) values." } }, "description": "Carries metadata that constrains matching credentials." } } }, "description": "Lists the credential queries in the presentation request." } }, "description": "Contains the DCQL (Digital Credentials Query Language) query the wallet evaluates." }, "nonce": { "type": "string", "example": "", "description": "Carries the nonce the wallet must bind into the presentation response." }, "purpose": { "type": "string", "example": "Verify loyalty tier for lounge access", "description": "Explains why the verifier requests the presentation." }, "requested_claims": { "type": "array", "items": { "type": "string", "example": "tier" }, "description": "Lists the claim names the verifier asks the holder to disclose." }, "requested_vct": { "type": "string", "example": "AirlineLoyalty", "description": "Names the requested VCT (Verifiable Credential Type)." }, "status": { "type": "string", "example": "pending", "description": "Shows the current state of the presentation request.", "enum": [ "pending", "verified", "failed" ] }, "transaction_id": { "type": "string", "example": "287d95fb-798b-47ee-9762-ccafca4aa3b0", "description": "Binds the presentation request to the later verification result.", "format": "uuid" }, "trusted_iss": { "type": "string", "example": "", "description": "Returns the trusted issuer value configured for the request." }, "uuid": { "type": "string", "example": "1a2a5c82-3779-424b-a900-2062fdfaf5d2", "description": "Identifies the presentation request.", "format": "uuid" }, "relying_party": { "type": [ "string", "null" ], "description": "You receive the relying party UUID this request is scoped to, or null when it is not scoped to one.", "example": null, "format": "uuid" }, "trust_policy": { "type": "string", "description": "You receive the effective trust policy for this request: `tenant` or `custom`.", "example": "tenant" } } } }, "example": [ { "aud": "checkin-rp", "created_at": "2026-07-02T23:51:57.366681Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "status": "pending", "transaction_id": "287d95fb-798b-47ee-9762-ccafca4aa3b0", "trusted_iss": "", "uuid": "1a2a5c82-3779-424b-a900-2062fdfaf5d2" }, { "aud": "checkin-rp", "created_at": "2026-07-02T23:51:57.360146Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "status": "pending", "transaction_id": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2", "trusted_iss": "", "uuid": "b713a8e2-9a10-4050-b800-6917b5ac50d7" }, { "aud": "partner-portal", "created_at": "2026-07-02T23:51:56.411321Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "member_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "MembershipCard" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "member_id" ], "requested_vct": "MembershipCard", "status": "verified", "transaction_id": "f92d71ad-8dfb-41ab-b96a-4b1492187edf", "trusted_iss": "", "uuid": "f036007d-a1ef-4e28-a274-f3622f825e61" }, { "aud": "gate-check", "created_at": "2026-07-02T23:51:56.406050Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "over_18" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AgeOver18" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "over_18" ], "requested_vct": "AgeOver18", "status": "verified", "transaction_id": "f9c18fa4-62ab-4700-8897-505606efb425", "trusted_iss": "", "uuid": "cc9f1072-ba5c-4f83-916b-d6cedd7c3202" }, { "aud": "campus-door", "created_at": "2026-07-02T23:51:56.404588Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "student_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "StudentID" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "student_id" ], "requested_vct": "StudentID", "status": "failed", "transaction_id": "12c35261-6cd9-48d9-9005-dc3039dc99b5", "trusted_iss": "", "uuid": "113ce031-764b-467f-85f3-fd408121f132" }, { "aud": "partner-portal", "created_at": "2026-07-02T23:51:56.398292Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "employee_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "EmployeeBadge" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "employee_id" ], "requested_vct": "EmployeeBadge", "status": "verified", "transaction_id": "2538c162-7ec5-44da-96e2-4fa35b5984ec", "trusted_iss": "", "uuid": "17783b2b-4513-46b3-b05c-19ab6d105121" }, { "aud": "gate-check", "created_at": "2026-07-02T23:51:56.392462Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "given_name" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "given_name" ], "requested_vct": "AirlineLoyalty", "status": "verified", "transaction_id": "566153aa-c113-467d-ae34-e217163277ce", "trusted_iss": "", "uuid": "32f5432a-5dc4-416a-bf57-549e648d19ae" } ] } } } }, "security": [ { "bearerAuth": [] } ], "summary": "List the tenant's presentation requests (alias of /presentations/requests).", "description": "List your tenant's OpenID4VP (OpenID for Verifiable Presentations) presentation requests. This alias returns the same bare JSON array as `GET /v1/presentations/requests`." }, "post": { "operationId": "v1_presentations_request_create", "tags": [ "OpenID4VP Verification" ], "responses": { "201": { "description": "Returns the created presentation request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Identifies the presentation request.", "example": "71889d7a-67c1-4ce9-bb73-5e99cd4c0265", "format": "uuid" }, "transaction_id": { "type": "string", "description": "Binds the presentation request to the later verification result.", "example": "1aa51264-f2d2-4a97-86b8-940a9c0e1188", "format": "uuid" }, "dcql": { "type": "object", "description": "Contains the DCQL (Digital Credentials Query Language) query the wallet evaluates.", "example": { "credentials": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ] }, "properties": { "credentials": { "type": "array", "description": "Lists the credential queries in the presentation request.", "example": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ], "items": { "type": "object", "description": "Describes one credential query.", "example": { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } }, "properties": { "id": { "type": "string", "description": "Identifies the credential query inside the DCQL (Digital Credentials Query Language) payload.", "example": "" }, "format": { "type": "string", "description": "Names the credential format requested by this query.", "example": "" }, "meta": { "type": "object", "description": "Carries metadata that constrains matching credentials.", "example": { "vct_values": [ "" ] }, "properties": { "vct_values": { "type": "array", "description": "Lists accepted VCT (Verifiable Credential Type) values.", "example": [ "" ], "items": { "type": "string", "description": "One accepted VCT (Verifiable Credential Type) value.", "example": "" } } } }, "claims": { "type": "array", "description": "Lists the claim paths the verifier asks the holder to disclose.", "example": [ { "path": [ "" ] } ], "items": { "type": "object", "description": "Describes one requested claim path.", "example": { "path": [ "" ] }, "properties": { "path": { "type": "array", "description": "Identifies the requested claim path.", "example": [ "" ], "items": { "type": "string", "description": "One segment of the requested claim path.", "example": "" } } } } } } } } } }, "requested_vct": { "type": "string", "description": "Names the requested VCT (Verifiable Credential Type).", "example": "AirlineLoyalty" }, "requested_claims": { "type": "array", "description": "Lists the claim names requested for disclosure.", "example": [ "tier" ], "items": { "type": "string", "description": "One requested claim name.", "example": "tier" } }, "aud": { "type": "string", "description": "Identifies the verifier audience for the presentation.", "example": "checkin-rp" }, "nonce": { "type": "string", "description": "Carries the nonce the wallet must bind into the presentation response.", "example": "" }, "purpose": { "type": "string", "description": "Explains why the verifier requests the presentation.", "example": "Verify loyalty tier for lounge access" }, "trusted_iss": { "type": "string", "description": "Returns the trusted issuer value configured for the request.", "example": "" }, "status": { "type": "string", "description": "Shows the initial state of the presentation request.", "example": "pending", "enum": [ "pending" ] }, "created_at": { "type": "string", "description": "Records when the presentation request was created.", "example": "2026-07-02T23:33:33.500617Z", "format": "date-time" }, "relying_party": { "type": [ "string", "null" ], "description": "You receive the relying party UUID this request is scoped to, or null when it is not scoped to one.", "example": null, "format": "uuid" }, "trust_policy": { "type": "string", "description": "You receive the effective trust policy for this request: `tenant` or `custom`.", "example": "tenant" } } }, "example": { "aud": "checkin-rp", "created_at": "2026-07-02T23:51:57.360146Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "status": "pending", "transaction_id": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2", "trusted_iss": "", "uuid": "b713a8e2-9a10-4050-b800-6917b5ac50d7" } } } } }, "summary": "Create an OpenID4VP presentation request (DCQL)", "description": "Create an OpenID4VP (OpenID for Verifiable Presentations) presentation request. You provide the requested VCT (Verifiable Credential Type), requested claims, audience, and purpose, and the API returns a nonce plus a DCQL (Digital Credentials Query Language) query.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "requested_vct": { "type": "string", "description": "Names the VCT (Verifiable Credential Type) you want the holder to present.", "example": "AirlineLoyalty" }, "requested_claims": { "type": "array", "description": "Lists the claim names you want the holder to disclose.", "example": [ "tier" ], "items": { "type": "string", "description": "One requested claim name.", "example": "tier" } }, "aud": { "type": "string", "description": "Identifies your verifier audience for the presentation.", "example": "checkin-rp" }, "purpose": { "type": "string", "description": "Explains why you request the presentation.", "example": "Verify loyalty tier for lounge access" }, "relying_party_id": { "type": "string", "description": "You optionally scope this request to a registered relying party by UUID. When set, the relying party's per-RP trust rules apply on top of the tenant registry.", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "format": "uuid" } }, "required": [ "requested_vct", "aud" ] }, "example": { "aud": "checkin-rp", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty" } } } } } }, "/v1/presentations/requests": { "get": { "operationId": "v1_presentations_requests_retrieve", "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns a bare JSON array. Each array element is one presentation request.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "aud": { "type": "string", "example": "checkin-rp", "description": "Identifies the verifier audience for the presentation." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.360146Z", "description": "Records when the presentation request was created.", "format": "date-time" }, "dcql": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "type": "object", "properties": { "claims": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "string", "example": "tier" }, "description": "Identifies the requested claim path." } } }, "description": "Lists the claim paths the verifier asks the holder to disclose." }, "format": { "type": "string", "example": "dc+sd-jwt", "description": "Names the credential format requested by this query." }, "id": { "type": "string", "example": "cred1", "description": "Identifies the credential query inside the DCQL (Digital Credentials Query Language) payload." }, "meta": { "type": "object", "properties": { "vct_values": { "type": "array", "items": { "type": "string", "example": "AirlineLoyalty" }, "description": "Lists accepted VCT (Verifiable Credential Type) values." } }, "description": "Carries metadata that constrains matching credentials." } } }, "description": "Lists the credential queries in the presentation request." } }, "description": "Contains the DCQL (Digital Credentials Query Language) query the wallet evaluates." }, "nonce": { "type": "string", "example": "", "description": "Carries the nonce the wallet must bind into the presentation response." }, "purpose": { "type": "string", "example": "Verify loyalty tier for lounge access", "description": "Explains why the verifier requests the presentation." }, "requested_claims": { "type": "array", "items": { "type": "string", "example": "tier" }, "description": "Lists the claim names the verifier asks the holder to disclose." }, "requested_vct": { "type": "string", "example": "AirlineLoyalty", "description": "Names the requested VCT (Verifiable Credential Type)." }, "status": { "type": "string", "example": "pending", "description": "Shows the current state of the presentation request.", "enum": [ "pending", "verified", "failed" ] }, "transaction_id": { "type": "string", "example": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2", "description": "Binds the presentation request to the later verification result.", "format": "uuid" }, "trusted_iss": { "type": "string", "example": "", "description": "Returns the trusted issuer value configured for the request." }, "uuid": { "type": "string", "example": "b713a8e2-9a10-4050-b800-6917b5ac50d7", "description": "Identifies the presentation request.", "format": "uuid" }, "relying_party": { "type": [ "string", "null" ], "description": "You receive the relying party UUID this request is scoped to, or null when it is not scoped to one.", "example": null, "format": "uuid" }, "trust_policy": { "type": "string", "description": "You receive the effective trust policy for this request: `tenant` or `custom`.", "example": "tenant" } } } }, "example": [ { "aud": "checkin-rp", "created_at": "2026-07-02T23:51:57.360146Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "status": "pending", "transaction_id": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2", "trusted_iss": "", "uuid": "b713a8e2-9a10-4050-b800-6917b5ac50d7" }, { "aud": "partner-portal", "created_at": "2026-07-02T23:51:56.411321Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "member_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "MembershipCard" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "member_id" ], "requested_vct": "MembershipCard", "status": "verified", "transaction_id": "f92d71ad-8dfb-41ab-b96a-4b1492187edf", "trusted_iss": "", "uuid": "f036007d-a1ef-4e28-a274-f3622f825e61" }, { "aud": "gate-check", "created_at": "2026-07-02T23:51:56.406050Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "over_18" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AgeOver18" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "over_18" ], "requested_vct": "AgeOver18", "status": "verified", "transaction_id": "f9c18fa4-62ab-4700-8897-505606efb425", "trusted_iss": "", "uuid": "cc9f1072-ba5c-4f83-916b-d6cedd7c3202" }, { "aud": "campus-door", "created_at": "2026-07-02T23:51:56.404588Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "student_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "StudentID" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "student_id" ], "requested_vct": "StudentID", "status": "failed", "transaction_id": "12c35261-6cd9-48d9-9005-dc3039dc99b5", "trusted_iss": "", "uuid": "113ce031-764b-467f-85f3-fd408121f132" }, { "aud": "partner-portal", "created_at": "2026-07-02T23:51:56.398292Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "employee_id" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "EmployeeBadge" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "employee_id" ], "requested_vct": "EmployeeBadge", "status": "verified", "transaction_id": "2538c162-7ec5-44da-96e2-4fa35b5984ec", "trusted_iss": "", "uuid": "17783b2b-4513-46b3-b05c-19ab6d105121" }, { "aud": "gate-check", "created_at": "2026-07-02T23:51:56.392462Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "given_name" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "", "requested_claims": [ "given_name" ], "requested_vct": "AirlineLoyalty", "status": "verified", "transaction_id": "566153aa-c113-467d-ae34-e217163277ce", "trusted_iss": "", "uuid": "32f5432a-5dc4-416a-bf57-549e648d19ae" } ] } } } }, "security": [ { "bearerAuth": [] } ], "summary": "List the tenant's presentation requests.", "description": "List your tenant's OpenID4VP (OpenID for Verifiable Presentations) presentation requests. Use this endpoint to inspect request status, requested claims, and the generated DCQL (Digital Credentials Query Language) query." }, "post": { "operationId": "v1_presentations_requests_create", "tags": [ "OpenID4VP Verification" ], "responses": { "201": { "description": "Successful response.", "content": { "application/json": { "schema": { "type": "object", "properties": { "aud": { "type": "string", "example": "checkin-rp" }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.366681Z" }, "dcql": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "type": "object", "properties": { "claims": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "string", "example": "tier" } } } } }, "format": { "type": "string", "example": "dc+sd-jwt" }, "id": { "type": "string", "example": "cred1" }, "meta": { "type": "object", "properties": { "vct_values": { "type": "array", "items": { "type": "string", "example": "AirlineLoyalty" } } } } } } } } }, "nonce": { "type": "string", "example": "" }, "purpose": { "type": "string", "example": "Verify loyalty tier for lounge access" }, "requested_claims": { "type": "array", "items": { "type": "string", "example": "tier" } }, "requested_vct": { "type": "string", "example": "AirlineLoyalty" }, "status": { "type": "string", "example": "pending" }, "transaction_id": { "type": "string", "example": "287d95fb-798b-47ee-9762-ccafca4aa3b0" }, "trusted_iss": { "type": "string", "example": "" }, "uuid": { "type": "string", "example": "1a2a5c82-3779-424b-a900-2062fdfaf5d2" }, "relying_party": { "type": [ "string", "null" ], "description": "You receive the relying party UUID this request is scoped to, or null when it is not scoped to one.", "example": null, "format": "uuid" }, "trust_policy": { "type": "string", "description": "You receive the effective trust policy for this request: `tenant` or `custom`.", "example": "tenant" } } }, "example": { "aud": "checkin-rp", "created_at": "2026-07-02T23:51:57.366681Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "status": "pending", "transaction_id": "287d95fb-798b-47ee-9762-ccafca4aa3b0", "trusted_iss": "", "uuid": "1a2a5c82-3779-424b-a900-2062fdfaf5d2" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Create a presentation request (alias of POST /v1/presentations/request)", "description": "Create a presentation request (alias of POST /v1/presentations/request).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "aud": { "type": "string", "example": "checkin-rp" }, "purpose": { "type": "string", "example": "Verify loyalty tier for lounge access" }, "requested_claims": { "type": "array", "items": { "type": "string", "example": "tier" } }, "requested_vct": { "type": "string", "example": "AirlineLoyalty" }, "relying_party_id": { "type": "string", "description": "You optionally scope this request to a registered relying party by UUID. When set, the relying party's per-RP trust rules apply on top of the tenant registry.", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "format": "uuid" } } }, "example": { "aud": "checkin-rp", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty" } } } } } }, "/v1/presentations/{uuid}": { "get": { "operationId": "v1_presentations_retrieve", "description": "Fetch the holder-facing view of one OpenID4VP (OpenID for Verifiable Presentations) presentation request. You can use it to render the requester, purpose, requested claims, and current request status.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Identifies the presentation request to fetch.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns the public presentation request view for the holder.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Identifies the presentation request.", "example": "71889d7a-67c1-4ce9-bb73-5e99cd4c0265", "format": "uuid" }, "transaction_id": { "type": "string", "description": "Binds the presentation request to the later verification result.", "example": "1aa51264-f2d2-4a97-86b8-940a9c0e1188", "format": "uuid" }, "dcql": { "type": "object", "description": "Contains the DCQL (Digital Credentials Query Language) query the wallet evaluates.", "example": { "credentials": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ] }, "properties": { "credentials": { "type": "array", "description": "Lists the credential queries in the presentation request.", "example": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ], "items": { "type": "object", "description": "Describes one credential query.", "example": { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } }, "properties": { "id": { "type": "string", "description": "Identifies the credential query inside the DCQL (Digital Credentials Query Language) payload.", "example": "" }, "format": { "type": "string", "description": "Names the credential format requested by this query.", "example": "" }, "meta": { "type": "object", "description": "Carries metadata that constrains matching credentials.", "example": { "vct_values": [ "" ] }, "properties": { "vct_values": { "type": "array", "description": "Lists accepted VCT (Verifiable Credential Type) values.", "example": [ "" ], "items": { "type": "string", "description": "One accepted VCT (Verifiable Credential Type) value.", "example": "" } } } }, "claims": { "type": "array", "description": "Lists the claim paths the verifier asks the holder to disclose.", "example": [ { "path": [ "" ] } ], "items": { "type": "object", "description": "Describes one requested claim path.", "example": { "path": [ "" ] }, "properties": { "path": { "type": "array", "description": "Identifies the requested claim path.", "example": [ "" ], "items": { "type": "string", "description": "One segment of the requested claim path.", "example": "" } } } } } } } } } }, "requested_vct": { "type": "string", "description": "Names the requested VCT (Verifiable Credential Type).", "example": "AirlineLoyalty" }, "requested_claims": { "type": "array", "description": "Lists the claim names the verifier asks the holder to disclose.", "example": [ "tier" ], "items": { "type": "string", "description": "One requested claim name.", "example": "tier" } }, "aud": { "type": "string", "description": "Identifies the verifier audience for the presentation.", "example": "checkin-rp" }, "nonce": { "type": "string", "description": "Carries the nonce the wallet must bind into the presentation response.", "example": "" }, "purpose": { "type": "string", "description": "Explains why the verifier requests the presentation.", "example": "Verify loyalty tier for lounge access" }, "trusted_iss": { "type": "string", "description": "Returns the trusted issuer value configured for the request.", "example": "" }, "status": { "type": "string", "description": "Shows the current state of this presentation request.", "example": "pending", "enum": [ "pending" ] }, "created_at": { "type": "string", "description": "Records when the presentation request was created.", "example": "2026-07-02T23:33:33.500617Z", "format": "date-time" }, "requester": { "type": "object", "description": "Describes the relying party shown to the holder.", "example": { "did": "did:web:docs-capture-6clew6.didit.test", "id": "relying-party", "name": "checkin-rp", "purpose": "Verify loyalty tier for lounge access" }, "properties": { "id": { "type": "string", "description": "Identifies the requester role.", "example": "relying-party" }, "name": { "type": "string", "description": "Shows the requester name to the holder.", "example": "checkin-rp" }, "did": { "type": "string", "description": "Identifies the requester with a decentralized identifier.", "example": "did:web:docs-capture-6clew6.didit.test" }, "purpose": { "type": "string", "description": "Explains why this requester asks for the presentation.", "example": "Verify loyalty tier for lounge access" } } }, "claims": { "type": "array", "description": "Lists the holder-facing claims requested for disclosure.", "example": [ { "label": "Tier", "name": "tier", "requested": true, "selective_disclosure": true } ], "items": { "type": "object", "description": "Describes one requested claim.", "example": { "label": "Tier", "name": "tier", "requested": true, "selective_disclosure": true }, "properties": { "name": { "type": "string", "description": "Names the requested claim.", "example": "tier" }, "label": { "type": "string", "description": "Shows the display label for the claim.", "example": "Tier" }, "requested": { "type": "boolean", "description": "Indicates whether the verifier requested this claim.", "example": true }, "selective_disclosure": { "type": "boolean", "description": "Indicates whether the holder can disclose this claim selectively.", "example": true } } } } } }, "example": { "aud": "checkin-rp", "claims": [ { "label": "Tier", "name": "tier", "requested": true, "selective_disclosure": true } ], "created_at": "2026-07-02T23:51:57.360146Z", "dcql": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "purpose": "Verify loyalty tier for lounge access", "requested_claims": [ "tier" ], "requested_vct": "AirlineLoyalty", "requester": { "did": "did:web:docs-capture-z2373a.didit.test", "id": "relying-party", "name": "checkin-rp", "purpose": "Verify loyalty tier for lounge access" }, "status": "pending", "transaction_id": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2", "trusted_iss": "", "uuid": "b713a8e2-9a10-4050-b800-6917b5ac50d7" } } } } }, "summary": "Poll a presentation request (holder + status)", "security": [] } }, "/v1/presentations/{uuid}/request": { "get": { "operationId": "v1_presentations_request_retrieve_2", "description": "Fetch the public OpenID4VP (OpenID for Verifiable Presentations) request parameters for a wallet. You receive the response mode, response URI, state, nonce, and DCQL (Digital Credentials Query Language) query.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Identifies the presentation request to dereference.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns the wallet-facing request parameters.", "content": { "application/json": { "schema": { "type": "object", "properties": { "client_id": { "type": "string", "description": "Identifies the verifier client for the wallet.", "example": "checkin-rp" }, "response_type": { "type": "string", "description": "Tells the wallet to return a verifiable presentation token.", "example": "vp_token", "enum": [ "vp_token" ] }, "response_mode": { "type": "string", "description": "Tells the wallet to post the response directly to the response URI.", "example": "direct_post", "enum": [ "direct_post" ] }, "response_uri": { "type": "string", "description": "Receives the wallet's presentation response.", "example": "http://localhost:8011/v1/presentations/71889d7a-67c1-4ce9-bb73-5e99cd4c0265/response", "format": "uri" }, "state": { "type": "string", "description": "Carries the transaction state the wallet returns with the response.", "example": "1aa51264-f2d2-4a97-86b8-940a9c0e1188", "format": "uuid" }, "nonce": { "type": "string", "description": "Carries the nonce the wallet must bind into the presentation response.", "example": "" }, "dcql_query": { "type": "object", "description": "Contains the DCQL (Digital Credentials Query Language) query the wallet evaluates.", "example": { "credentials": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ] }, "properties": { "credentials": { "type": "array", "description": "Lists the credential queries in the wallet request.", "example": [ { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } } ], "items": { "type": "object", "description": "Describes one credential query.", "example": { "claims": [ { "path": [ "" ] } ], "format": "", "id": "", "meta": { "vct_values": [ "" ] } }, "properties": { "id": { "type": "string", "description": "Identifies the credential query inside the DCQL (Digital Credentials Query Language) payload.", "example": "" }, "format": { "type": "string", "description": "Names the credential format requested by this query.", "example": "" }, "meta": { "type": "object", "description": "Carries metadata that constrains matching credentials.", "example": { "vct_values": [ "" ] }, "properties": { "vct_values": { "type": "array", "description": "Lists accepted VCT (Verifiable Credential Type) values.", "example": [ "" ], "items": { "type": "string", "description": "One accepted VCT (Verifiable Credential Type) value.", "example": "" } } } }, "claims": { "type": "array", "description": "Lists the claim paths the verifier asks the holder to disclose.", "example": [ { "path": [ "" ] } ], "items": { "type": "object", "description": "Describes one requested claim path.", "example": { "path": [ "" ] }, "properties": { "path": { "type": "array", "description": "Identifies the requested claim path.", "example": [ "" ], "items": { "type": "string", "description": "One segment of the requested claim path.", "example": "" } } } } } } } } } } } }, "example": { "client_id": "checkin-rp", "dcql_query": { "credentials": [ { "claims": [ { "path": [ "tier" ] } ], "format": "dc+sd-jwt", "id": "cred1", "meta": { "vct_values": [ "AirlineLoyalty" ] } } ] }, "nonce": "", "response_mode": "direct_post", "response_type": "vp_token", "response_uri": "http://localhost:8011/v1/presentations/b713a8e2-9a10-4050-b800-6917b5ac50d7/response", "state": "dd82f2c2-4c7b-477d-a1b6-4f0f95fd2af2" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "The signed OpenID4VP request parameters a wallet dereferences (public)." } }, "/v1/presentations/{uuid}/response": { "post": { "operationId": "v1_presentations_response_create", "description": "Submit a wallet response for an OpenID4VP (OpenID for Verifiable Presentations) presentation request. You post the `vp_token`, and the API verifies the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential), KB-JWT (Key-Binding JWT), nonce, audience, revocation status, and signature.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Identifies the presentation request being answered.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns a verified presentation response.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Identifies the verification result.", "example": "7b2322e2-4cdf-4167-b718-ee29183b1bf2", "format": "uuid" }, "verdict": { "type": "string", "description": "Shows whether the presentation verified successfully.", "example": "verified", "enum": [ "verified" ] }, "disclosed_claims": { "type": "object", "description": "Contains the claims the holder disclosed.", "example": { "tier": "gold" }, "properties": { "tier": { "type": "string", "description": "Shows the disclosed `tier` claim value.", "example": "gold" } } }, "checks": { "type": "object", "description": "Reports the verification checks recorded for this response.", "example": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "properties": { "alg_allowlist": { "type": "boolean", "description": "Shows whether the signing algorithms passed the allowlist check.", "example": true }, "aud": { "type": "boolean", "description": "Shows whether the audience check passed.", "example": true }, "key_binding": { "type": "boolean", "description": "Shows whether the KB-JWT (Key-Binding JWT) holder binding check passed.", "example": true }, "nonce": { "type": "boolean", "description": "Shows whether the nonce check passed.", "example": true }, "not_expired": { "type": "boolean", "description": "Shows whether the credential was still valid at verification time.", "example": true }, "not_revoked": { "type": "boolean", "description": "Shows whether the credential passed the revocation check.", "example": true }, "signature": { "type": "boolean", "description": "Shows whether the credential signature check passed.", "example": true } } }, "error": { "type": "string", "description": "Returns an empty string on success or a failure reason when verification fails.", "example": "" }, "created_at": { "type": "string", "description": "Records when the verification result was created.", "example": "2026-07-02T23:33:33.575716Z", "format": "date-time" } } }, "example": { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:57.440034Z", "disclosed_claims": { "tier": "gold" }, "error": "", "uuid": "8b58a284-a711-4406-b2f4-dfece3741c36", "verdict": "verified" } } } }, "422": { "description": "Unprocessable \u2014 the credential presentation could not be verified. (Example: malformed vp_token fails verification.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "verdict": { "type": "string", "description": "Shows that verification failed.", "example": "failed", "enum": [ "failed" ] }, "checks": { "type": "object", "description": "Returns the checks captured for the failed response.", "example": {}, "properties": {} }, "error": { "type": "string", "description": "Explains why verification failed.", "example": "SignatureError: malformed issuer JWS: 'utf-8' codec can't decode byte 0x9e in position 0: invalid start byte" } } }, "example": { "checks": {}, "error": "SignatureError: malformed issuer JWS: 'utf-8' codec can't decode byte 0x9e in position 0: invalid start byte", "verdict": "failed" } } } } }, "summary": "Submit a vp_token for verification", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "vp_token": { "type": "string", "description": "Contains the OpenID4VP (OpenID for Verifiable Presentations) presentation token from the wallet.", "example": "" } }, "required": [ "vp_token" ] }, "example": { "vp_token": "" } } } } } }, "/v1/presentations/{uuid}/demo-present": { "post": { "operationId": "v1_presentations_demo_present_create", "description": "Ask the server to demo-present a sample credential against an OpenID4VP (OpenID for Verifiable Presentations) request. This development shortcut returns a verification result and is unavailable in production.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Identifies the presentation request to answer with a demo presentation.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns the verification result created by the demo presentation.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "Identifies the verification result.", "example": "f70dd438-88e0-4d48-946c-53138aaa588d", "format": "uuid" }, "request_id": { "type": "string", "description": "Identifies the presentation request that produced this result.", "example": "15115783-0a0a-4d5e-b096-ea5b8eb87067", "format": "uuid" }, "verdict": { "type": "string", "description": "Shows whether the demo presentation verified successfully.", "example": "verified", "enum": [ "verified" ] }, "vct": { "type": "string", "description": "Names the VCT (Verifiable Credential Type) that was verified.", "example": "AirlineLoyalty" }, "verifier": { "type": "string", "description": "Identifies the verifier audience for the presentation.", "example": "checkin-rp" }, "requested_claims": { "type": "array", "description": "Lists the claim names requested for disclosure.", "example": [ "tier" ], "items": { "type": "string", "description": "One requested claim name.", "example": "tier" } }, "disclosed_claims": { "type": "object", "description": "Contains the demo claims disclosed during verification.", "example": { "tier": "demo-tier" }, "properties": { "tier": { "type": "string", "description": "Shows the disclosed `tier` claim value.", "example": "demo-tier" } } }, "checks": { "type": "object", "description": "Reports the verification checks recorded for this result.", "example": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "properties": { "alg_allowlist": { "type": "boolean", "description": "Shows whether the signing algorithms passed the allowlist check.", "example": true }, "aud": { "type": "boolean", "description": "Shows whether the audience check passed.", "example": true }, "key_binding": { "type": "boolean", "description": "Shows whether the KB-JWT (Key-Binding JWT) holder binding check passed.", "example": true }, "nonce": { "type": "boolean", "description": "Shows whether the nonce check passed.", "example": true }, "not_expired": { "type": "boolean", "description": "Shows whether the credential was still valid at verification time.", "example": true }, "not_revoked": { "type": "boolean", "description": "Shows whether the credential passed the revocation check.", "example": true }, "signature": { "type": "boolean", "description": "Shows whether the credential signature check passed.", "example": true } } }, "error": { "type": "string", "description": "Returns an empty string on success or a failure reason when verification fails.", "example": "" }, "created_at": { "type": "string", "description": "Records when the verification result was created.", "example": "2026-07-02T23:33:33.599983+00:00", "format": "date-time" } } }, "example": { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:57.463767+00:00", "disclosed_claims": { "tier": "demo-tier" }, "error": "", "id": "222e597f-96ff-4c63-a08f-6587c5a6d058", "request_id": "92e1ced4-84e5-4601-8588-4ce4925db178", "requested_claims": [ "tier" ], "vct": "AirlineLoyalty", "verdict": "verified", "verifier": "checkin-rp" } } } }, "422": { "description": "The demo presentation failed verification, the request was already used, or no credential template exists for the request's `vct`. On a recorded failure the body is the verification payload with verdict `failed`; on the no-template / already-used short-circuit it is a minimal failure shape (`verdict`, `error`, empty `checks`).", "content": { "application/json": { "schema": { "type": "object", "properties": { "verdict": { "type": "string", "description": "Always `failed` on a 422 response.", "example": "failed", "enum": [ "failed" ] }, "error": { "type": "string", "description": "Failure reason \u2014 e.g. a verification error, `request already used`, or `no template for vct {vct}` when the tenant has no credential template for the requested type.", "example": "no template for vct https://credentials.didit.me/vct/identity-card" }, "checks": { "type": "object", "description": "Empty object on the short-circuit failure shape; populated only when a full verification ran and failed.", "example": {}, "properties": {} } } } } } } }, "summary": "Demo: real server-side present + verify", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/verifications": { "get": { "operationId": "v1_verifications_retrieve", "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns a bare JSON array. Each array element is one verification result.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "checks": { "type": "object", "properties": { "alg_allowlist": { "type": "boolean", "example": true, "description": "Shows whether the signing algorithms passed the allowlist check." }, "aud": { "type": "boolean", "example": true, "description": "Shows whether the audience check passed." }, "key_binding": { "type": "boolean", "example": true, "description": "Shows whether the KB-JWT (Key-Binding JWT) holder binding check passed." }, "nonce": { "type": "boolean", "example": true, "description": "Shows whether the nonce check passed." }, "not_expired": { "type": "boolean", "example": true, "description": "Shows whether the credential was still valid at verification time." }, "not_revoked": { "type": "boolean", "example": true, "description": "Shows whether the credential passed the revocation check." }, "signature": { "type": "boolean", "example": true, "description": "Shows whether the credential signature check passed." } }, "description": "Reports the verification checks recorded for this result." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.440034+00:00", "description": "Records when the verification result was created.", "format": "date-time" }, "disclosed_claims": { "type": "object", "properties": { "tier": { "type": "string", "example": "gold", "description": "Shows the disclosed `tier` claim value." } }, "description": "Contains the claims the holder disclosed. The object is empty when the verdict is `failed`." }, "error": { "type": "string", "example": "", "description": "Returns an empty string on success or a failure reason when verification fails." }, "id": { "type": "string", "example": "8b58a284-a711-4406-b2f4-dfece3741c36", "description": "Identifies the verification result.", "format": "uuid" }, "request_id": { "type": "string", "example": "b713a8e2-9a10-4050-b800-6917b5ac50d7", "description": "Identifies the presentation request that produced this result.", "format": "uuid" }, "requested_claims": { "type": "array", "items": { "type": "string", "example": "tier" }, "description": "Lists the claim names requested for disclosure." }, "vct": { "type": "string", "example": "AirlineLoyalty", "description": "Names the VCT (Verifiable Credential Type) that was verified." }, "verdict": { "type": "string", "example": "verified", "description": "Shows whether verification succeeded or failed.", "enum": [ "verified", "failed" ] }, "verifier": { "type": "string", "example": "checkin-rp", "description": "Identifies the verifier audience for the presentation." } } } }, "example": [ { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:57.440034+00:00", "disclosed_claims": { "tier": "gold" }, "error": "", "id": "8b58a284-a711-4406-b2f4-dfece3741c36", "request_id": "b713a8e2-9a10-4050-b800-6917b5ac50d7", "requested_claims": [ "tier" ], "vct": "AirlineLoyalty", "verdict": "verified", "verifier": "checkin-rp" }, { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:56.415908+00:00", "disclosed_claims": { "member_id": "demo-member_id" }, "error": "", "id": "e35d91a5-9157-4edf-85c1-52ed770eeb4e", "request_id": "f036007d-a1ef-4e28-a274-f3622f825e61", "requested_claims": [ "member_id" ], "vct": "MembershipCard", "verdict": "verified", "verifier": "partner-portal" }, { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:56.410356+00:00", "disclosed_claims": { "over_18": "demo-over_18" }, "error": "", "id": "467e5da6-7649-4144-88f9-99f6665cade6", "request_id": "cc9f1072-ba5c-4f83-916b-d6cedd7c3202", "requested_claims": [ "over_18" ], "vct": "AgeOver18", "verdict": "verified", "verifier": "gate-check" }, { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": false, "signature": true }, "created_at": "2026-07-02T23:51:56.405041+00:00", "disclosed_claims": {}, "error": "Credential is revoked (status list bit set).", "id": "333bbe0a-945f-42ce-b3ed-8c1b0a5825b2", "request_id": "113ce031-764b-467f-85f3-fd408121f132", "requested_claims": [ "student_id" ], "vct": "StudentID", "verdict": "failed", "verifier": "campus-door" }, { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:56.403836+00:00", "disclosed_claims": { "employee_id": "demo-employee_id" }, "error": "", "id": "b2ae33e8-c001-41ee-85a5-f25ec007f49f", "request_id": "17783b2b-4513-46b3-b05c-19ab6d105121", "requested_claims": [ "employee_id" ], "vct": "EmployeeBadge", "verdict": "verified", "verifier": "partner-portal" }, { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:56.397534+00:00", "disclosed_claims": { "given_name": "demo-given_name" }, "error": "", "id": "12743871-a649-431a-8f28-f628edc3233b", "request_id": "32f5432a-5dc4-416a-bf57-549e648d19ae", "requested_claims": [ "given_name" ], "vct": "AirlineLoyalty", "verdict": "verified", "verifier": "gate-check" } ] } } } }, "summary": "List verifications (log)", "description": "List completed verification results for your tenant. Each result shows the verdict, requested claims, disclosed claims, verifier, and verification checks.", "security": [ { "bearerAuth": [] } ] } }, "/v1/verifications/{uuid}": { "get": { "operationId": "v1_verifications_retrieve_2", "description": "Fetch one verification result for your tenant. You can look up the result by the UUID in the path.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Identifies the verification result to fetch.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VP Verification" ], "responses": { "200": { "description": "Returns the verification result.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "Identifies the verification result.", "example": "7b2322e2-4cdf-4167-b718-ee29183b1bf2", "format": "uuid" }, "request_id": { "type": "string", "description": "Identifies the presentation request that produced this result.", "example": "71889d7a-67c1-4ce9-bb73-5e99cd4c0265", "format": "uuid" }, "verdict": { "type": "string", "description": "Shows whether verification succeeded.", "example": "verified", "enum": [ "verified" ] }, "vct": { "type": "string", "description": "Names the VCT (Verifiable Credential Type) that was verified.", "example": "AirlineLoyalty" }, "verifier": { "type": "string", "description": "Identifies the verifier audience for the presentation.", "example": "checkin-rp" }, "requested_claims": { "type": "array", "description": "Lists the claim names requested for disclosure.", "example": [ "tier" ], "items": { "type": "string", "description": "One requested claim name.", "example": "tier" } }, "disclosed_claims": { "type": "object", "description": "Contains the claims the holder disclosed.", "example": { "tier": "gold" }, "properties": { "tier": { "type": "string", "description": "Shows the disclosed `tier` claim value.", "example": "gold" } } }, "checks": { "type": "object", "description": "Reports the verification checks recorded for this result.", "example": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "properties": { "alg_allowlist": { "type": "boolean", "description": "Shows whether the signing algorithms passed the allowlist check.", "example": true }, "aud": { "type": "boolean", "description": "Shows whether the audience check passed.", "example": true }, "key_binding": { "type": "boolean", "description": "Shows whether the KB-JWT (Key-Binding JWT) holder binding check passed.", "example": true }, "nonce": { "type": "boolean", "description": "Shows whether the nonce check passed.", "example": true }, "not_expired": { "type": "boolean", "description": "Shows whether the credential was still valid at verification time.", "example": true }, "not_revoked": { "type": "boolean", "description": "Shows whether the credential passed the revocation check.", "example": true }, "signature": { "type": "boolean", "description": "Shows whether the credential signature check passed.", "example": true } } }, "error": { "type": "string", "description": "Returns an empty string on success or a failure reason when verification fails.", "example": "" }, "created_at": { "type": "string", "description": "Records when the verification result was created.", "example": "2026-07-02T23:33:33.575716+00:00", "format": "date-time" } } }, "example": { "checks": { "alg_allowlist": true, "aud": true, "key_binding": true, "nonce": true, "not_expired": true, "not_revoked": true, "signature": true }, "created_at": "2026-07-02T23:51:57.440034+00:00", "disclosed_claims": { "tier": "gold" }, "error": "", "id": "8b58a284-a711-4406-b2f4-dfece3741c36", "request_id": "b713a8e2-9a10-4050-b800-6917b5ac50d7", "requested_claims": [ "tier" ], "vct": "AirlineLoyalty", "verdict": "verified", "verifier": "checkin-rp" } } } } }, "summary": "Get a verification result", "security": [ { "bearerAuth": [] } ] } }, "/v1/status-lists/{slug}/{uuid}": { "get": { "operationId": "v1_status_lists_retrieve", "description": "Public, unauthenticated fetch of an entire IETF Token Status List compressed bitstring used for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) revocation and suspension. Verifiers fetch the whole list and read the bit at a credential's status index. Serving the full list instead of a single entry helps defend against correlation.", "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "The issuer tenant's URL slug. It scopes the lookup to that tenant.", "schema": { "type": "string" } }, { "name": "uuid", "in": "path", "required": true, "description": "UUID of the status list to fetch. It must belong to the tenant identified by `slug`.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "Status Lists" ], "responses": { "200": { "description": "The full status list as a base64url-encoded bitstring plus its URI and size.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uri": { "type": "string", "description": "Canonical absolute URI of this status list. Credentials reference this value from their status claim.", "example": "https://acme-air.didit.me/v1/status-lists/acme-air/9f0a1b2c-3d4e-5f6a-7b8c-9d0e1f2a3b4c", "format": "uri" }, "size": { "type": "integer", "description": "Number of bits in the status list.", "example": 131072 }, "bits_b64": { "type": "string", "description": "Status-list bitstring encoded as a base64url string. Decode it and read the bit at a credential's status index.", "example": "AAAAAAAAAAAAAAAAAAAAAA", "format": "byte" } } }, "example": { "bits_b64": "GIZhGDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u2026(truncated)", "size": 131072, "uri": "http://localhost:8011/v1/status-lists/docs-capture-z2373a/097648d0-379f-494b-ad67-87ee146ace1b" } } } } }, "summary": "Fetch a Token Status List (whole list)", "security": [] } }, "/v1/trust-frameworks": { "get": { "operationId": "v1_trust_frameworks_retrieve", "tags": [ "Trust Registry" ], "responses": { "200": { "description": "A bare JSON array of trust framework objects.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "custom": { "type": "boolean", "example": false, "description": "You receive `true` when the framework is tenant-owned." }, "description": { "type": "string", "example": "Mobile driving licence (proximity + online).", "description": "You receive the framework summary shown to API consumers." }, "editable": { "type": "boolean", "example": false, "description": "You receive `true` when you can update or delete the framework." }, "formats": { "type": "array", "items": { "type": "string", "example": "mdoc" }, "description": "You receive credential format identifiers such as `mdoc` or `sd_jwt_vc` for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential)." }, "governed": { "type": "boolean", "example": true, "description": "You receive `true` when a governance authority manages the framework." }, "id": { "type": "string", "example": "44f87e28-1869-46de-a029-af9dc748e1c0", "description": "You receive the stable UUID for this trust framework.", "format": "uuid" }, "name": { "type": "string", "example": "ISO/IEC 18013-5 mDL", "description": "You receive the display name for the framework." }, "profile": { "type": "string", "example": "ISO mDL", "description": "You receive the interoperability profile for the framework." }, "region": { "type": "string", "example": "Global", "description": "You receive the region or jurisdiction for the framework." }, "slug": { "type": "string", "example": "iso-mdl", "description": "You use this URL-safe identifier in the `framework` field when you register a trusted issuer." }, "trusted": { "type": "boolean", "description": "You receive `true` when this framework is currently trusted for the tenant. Governed frameworks are trusted by default.", "example": true }, "member_issuer_count": { "type": "integer", "description": "You receive the number of trusted issuers registered under this framework for the tenant.", "example": 3 } } } }, "example": [ { "custom": false, "description": "Mobile driving licence (proximity + online).", "editable": false, "formats": [ "mdoc" ], "governed": true, "id": "44f87e28-1869-46de-a029-af9dc748e1c0", "name": "ISO/IEC 18013-5 mDL", "profile": "ISO mDL", "region": "Global", "slug": "iso-mdl" }, { "custom": false, "description": "Swiss federal e-ID.", "editable": false, "formats": [ "sd_jwt_vc" ], "governed": true, "id": "036ac374-efa4-482b-b79d-ad63d8fd387e", "name": "Swiss e-ID", "profile": "national", "region": "CH", "slug": "swiss-eid" }, { "custom": false, "description": "AAMVA Digital Trust Service.", "editable": false, "formats": [ "mdoc" ], "governed": true, "id": "a1eb7240-3160-4832-88a9-54d2fbf1f31b", "name": "US mDL (AAMVA)", "profile": "AAMVA", "region": "US", "slug": "us-mdl" }, { "custom": false, "description": "EU Digital Identity Wallet framework.", "editable": false, "formats": [ "sd_jwt_vc", "mdoc" ], "governed": true, "id": "d345d71c-8410-4705-9557-0bd8073f8c34", "name": "eIDAS 2.0 (EUDI)", "profile": "HAIP", "region": "EU", "slug": "eidas2" } ] } } } }, "summary": "List trust frameworks", "description": "List governed platform catalog and tenant custom trust frameworks. You use a framework slug when you register a trusted issuer. The response is a bare JSON array of framework objects.", "security": [ { "bearerAuth": [] } ] }, "post": { "operationId": "v1_trust_frameworks_create", "tags": [ "Trust Registry" ], "responses": { "201": { "description": "The custom trust framework was created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the stable UUID for this trust framework.", "example": "5225b027-6ce6-482e-8b99-5362dffb5a7e", "format": "uuid" }, "slug": { "type": "string", "description": "You receive the generated slug for the custom framework.", "example": "acme-partner-framework-ypr5" }, "name": { "type": "string", "description": "You receive the display name for the framework.", "example": "ACME Partner Framework ypr5" }, "region": { "type": "string", "description": "You receive the region or jurisdiction for the framework.", "example": "EU" }, "profile": { "type": "string", "description": "You receive the interoperability profile for the framework.", "example": "custom" }, "formats": { "type": "array", "description": "You receive credential format identifiers such as `sd_jwt_vc` for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential).", "example": [ "sd_jwt_vc" ], "items": { "type": "string", "description": "You receive one credential format identifier.", "example": "sd_jwt_vc" } }, "description": { "type": "string", "description": "You receive the framework summary shown to API consumers.", "example": "Partner onboarding trust rules." }, "custom": { "type": "boolean", "description": "You receive `true` when the framework is tenant-owned.", "example": true }, "editable": { "type": "boolean", "description": "You receive `true` when you can update or delete the framework.", "example": true }, "governed": { "type": "boolean", "description": "You receive `true` when a governance authority manages the framework.", "example": false }, "trusted": { "type": "boolean", "description": "You receive `true` when this framework is currently trusted for the tenant. Governed frameworks are trusted by default.", "example": true }, "member_issuer_count": { "type": "integer", "description": "You receive the number of trusted issuers registered under this framework for the tenant.", "example": 3 } } }, "example": { "custom": true, "description": "Partner onboarding trust rules.", "editable": true, "formats": [ "sd_jwt_vc" ], "governed": false, "id": "ef84dbdc-c2d3-4b8d-91f7-3c94089ed228", "name": "ACME Partner Framework y4bf", "profile": "custom", "region": "EU", "slug": "acme-partner-framework-y4bf" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Create a custom, tenant-owned trust framework.", "description": "Create a custom trust framework for your tenant. You use the returned slug when you register trusted issuers. Governed frameworks are managed by their authority.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You set the display name for the custom framework.", "example": "ACME Partner Framework ypr5" }, "region": { "type": "string", "description": "You set the region or jurisdiction for the custom framework.", "example": "EU" }, "profile": { "type": "string", "description": "You set the interoperability profile for the custom framework.", "example": "custom" }, "formats": { "type": "array", "description": "You set the credential formats this framework accepts, such as `sd_jwt_vc` for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential).", "example": [ "sd_jwt_vc" ], "items": { "type": "string", "description": "You set one credential format identifier.", "example": "sd_jwt_vc" } }, "description": { "type": "string", "description": "You set the framework summary shown to API consumers.", "example": "Partner onboarding trust rules." } }, "required": [ "name", "formats" ] }, "example": { "description": "Partner onboarding trust rules.", "formats": [ "sd_jwt_vc" ], "name": "ACME Partner Framework y4bf", "profile": "custom", "region": "EU" } } } } } }, "/v1/trusted-issuers": { "get": { "operationId": "v1_trusted_issuers_retrieve", "tags": [ "Trust Registry" ], "responses": { "200": { "description": "A bare JSON array of trusted issuer objects for the caller's tenant.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "added_by": { "type": "string", "example": "TenantPrincipal", "description": "You receive the principal that registered this trusted issuer." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:58.727290+00:00", "description": "You receive the timestamp when this trusted issuer was registered.", "format": "date-time" }, "did": { "type": "string", "example": "", "description": "You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one." }, "framework": { "type": "string", "example": "acme-partner-framework-y4bf", "description": "You receive the associated framework slug, or null when the issuer is not tied to one." }, "id": { "type": "string", "example": "ef799a56-23dc-467d-9760-9fd20a8457fa", "description": "You receive the UUID for this trusted issuer registry entry.", "format": "uuid" }, "iss": { "type": "string", "example": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "description": "You receive the issuer identifier that credentials must match.", "format": "uri" }, "jwks_uri": { "type": "string", "example": "", "description": "You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one." }, "name": { "type": "string", "example": "Gov PID Issuer", "description": "You receive the trusted issuer display name." }, "status": { "type": "string", "example": "active", "description": "You receive the trust-gate status for this issuer." }, "trust_anchor": { "type": "string", "example": "https-jwks", "description": "You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured." }, "validation_state": { "type": "string", "description": "You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.", "example": "unverified" }, "last_validated_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.", "example": null, "format": "date-time" } } } }, "example": [ { "added_by": "TenantPrincipal", "created_at": "2026-07-02T23:51:58.727290+00:00", "did": "", "framework": "acme-partner-framework-y4bf", "id": "ef799a56-23dc-467d-9760-9fd20a8457fa", "iss": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "jwks_uri": "", "name": "Gov PID Issuer", "status": "active", "trust_anchor": "https-jwks" }, { "added_by": "system", "created_at": "2026-07-02T23:51:56.396577+00:00", "did": "", "framework": null, "id": "6618df5c-b4e7-401e-8321-70acb7e9744e", "iss": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "jwks_uri": "", "name": "docs-capture-z2373a (self)", "status": "active", "trust_anchor": "https-jwks" }, { "added_by": "demo-seed", "created_at": "2026-07-02T23:51:56.320771+00:00", "did": "", "framework": null, "id": "3effd357-8c2b-475a-baa9-6a55bda48f01", "iss": "https://access.initech.example", "jwks_uri": "", "name": "Initech Access", "status": "active", "trust_anchor": "https-jwks" }, { "added_by": "demo-seed", "created_at": "2026-07-02T23:51:56.320158+00:00", "did": "", "framework": null, "id": "916bc506-9793-4ef6-90fc-50e89ae17649", "iss": "https://hr.globex.example", "jwks_uri": "", "name": "Globex Corp HR", "status": "active", "trust_anchor": "https-jwks" }, { "added_by": "demo-seed", "created_at": "2026-07-02T23:51:56.319597+00:00", "did": "", "framework": null, "id": "051015ae-8b52-4c53-a6f4-fc23ff644eb0", "iss": "https://id.contoso.edu.example", "jwks_uri": "", "name": "Contoso University", "status": "active", "trust_anchor": "https-jwks" }, { "added_by": "demo-seed", "created_at": "2026-07-02T23:51:56.318638+00:00", "did": "", "framework": null, "id": "02ba969f-3a33-4a10-a7a2-3774d8286096", "iss": "https://issuer.acme-air.example", "jwks_uri": "", "name": "Acme Airlines", "status": "active", "trust_anchor": "https-jwks" } ] } } } }, "summary": "List trusted issuers", "description": "List the issuers this tenant trusts when verifying presented credentials. Didit ID rejects credentials whose `iss` value does not match an active trusted issuer. The response is a bare JSON array ordered by most recent creation time.", "security": [ { "bearerAuth": [] } ] }, "post": { "operationId": "v1_trusted_issuers_create", "tags": [ "Trust Registry" ], "responses": { "201": { "description": "The trusted issuer was registered.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for the trusted issuer registry entry.", "example": "18d3239a-4a0e-412b-9487-17ce7dc3bb8e", "format": "uuid" }, "name": { "type": "string", "description": "You receive the trusted issuer display name.", "example": "Gov PID Issuer" }, "iss": { "type": "string", "description": "You receive the issuer identifier that credentials must match.", "example": "http://localhost:8011/v1/issuers/docs-external-issuer-9r79lx", "format": "uri" }, "trust_anchor": { "type": "string", "description": "You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.", "example": "https-jwks" }, "jwks_uri": { "type": "string", "description": "You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "did": { "type": "string", "description": "You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "status": { "type": "string", "description": "You receive the trust-gate status for this issuer.", "example": "active" }, "added_by": { "type": "string", "description": "You receive the principal that registered this trusted issuer.", "example": "TenantPrincipal" }, "framework": { "type": [ "string", "null" ], "description": "You receive the associated framework slug, or null when the issuer is not tied to one.", "example": "acme-partner-framework-ypr5" }, "created_at": { "type": "string", "description": "You receive the timestamp when this trusted issuer was registered.", "example": "2026-07-02T23:33:35.153496+00:00", "format": "date-time" }, "validation_state": { "type": "string", "description": "You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.", "example": "unverified" }, "last_validated_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.", "example": null, "format": "date-time" } } }, "example": { "added_by": "TenantPrincipal", "created_at": "2026-07-02T23:51:58.727290+00:00", "did": "", "framework": "acme-partner-framework-y4bf", "id": "ef799a56-23dc-467d-9760-9fd20a8457fa", "iss": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "jwks_uri": "", "name": "Gov PID Issuer", "status": "active", "trust_anchor": "https-jwks" } } } }, "409": { "description": "Conflict \u2014 a trusted issuer with this `iss` already exists for the tenant.", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "You receive the reason the issuer could not be created.", "example": "Trusted issuer 'https://issuer.gov.example' already exists for this tenant." } } }, "example": { "detail": "Trusted issuer 'https://issuer.gov.example' already exists for this tenant." } } } } }, "summary": "Add a trusted issuer", "description": "Register an issuer whose credentials this tenant accepts. Didit ID uses the issuer identifier and trust anchor when it verifies presented credentials. The new entry starts as active.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You set the trusted issuer display name.", "example": "Gov PID Issuer" }, "iss": { "type": "string", "description": "You set the issuer identifier that credentials must match.", "example": "http://localhost:8011/v1/issuers/docs-external-issuer-9r79lx", "format": "uri" }, "trust_anchor": { "type": "string", "description": "You set the signing-key anchor type. Use `https-jwks` for a JSON Web Key Set (JWKS) based issuer.", "example": "https-jwks" }, "framework": { "type": "string", "description": "You set the trust framework slug to associate with this issuer.", "example": "acme-partner-framework-ypr5" }, "jwks_uri": { "type": "string", "description": "You optionally set the JSON Web Key Set (JWKS) endpoint used to resolve the issuer signing keys.", "example": "https://issuer.gov.example/.well-known/jwks.json", "format": "uri" }, "did": { "type": "string", "description": "You optionally set the decentralized identifier (DID) for the issuer.", "example": "" } }, "required": [ "name", "iss" ] }, "example": { "framework": "acme-partner-framework-y4bf", "iss": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "name": "Gov PID Issuer", "trust_anchor": "https-jwks" } } } } } }, "/v1/trusted-issuers/{uuid}": { "delete": { "operationId": "v1_trusted_issuers_destroy", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the trusted issuer registry entry to remove.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "Trust Registry" ], "responses": { "204": { "description": "The trusted issuer was removed. No response body is returned." } }, "summary": "Remove a trusted issuer", "description": "Remove an issuer from this tenant's trusted issuer registry. After removal, credentials from this issuer no longer pass the verification trust gate. A successful removal returns no response body.", "security": [ { "bearerAuth": [] } ] }, "patch": { "tags": [ "Trust Registry" ], "operationId": "patchTrustedIssuersUuid", "summary": "Update a trusted issuer", "description": "Update a trusted issuer's metadata (`name`, `trust_anchor`, `jwks_uri`, `did`, `framework`) or its `status` (`active` / `disabled`). The `iss` is immutable \u2014 attempting to change it returns 400; delete and recreate the issuer instead. Editing any metadata field resets `validation_state` to `unverified`. A disabled issuer stays in the registry but fails the verification trust gate.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "The trusted issuer status was updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for the trusted issuer registry entry.", "example": "18d3239a-4a0e-412b-9487-17ce7dc3bb8e", "format": "uuid" }, "name": { "type": "string", "description": "You receive the trusted issuer display name.", "example": "Gov PID Issuer" }, "iss": { "type": "string", "description": "You receive the issuer identifier that credentials must match.", "example": "http://localhost:8011/v1/issuers/docs-external-issuer-9r79lx", "format": "uri" }, "trust_anchor": { "type": "string", "description": "You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.", "example": "https-jwks" }, "jwks_uri": { "type": "string", "description": "You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "did": { "type": "string", "description": "You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "status": { "type": "string", "description": "You receive the updated trust-gate status for this issuer.", "example": "disabled" }, "added_by": { "type": "string", "description": "You receive the principal that registered this trusted issuer.", "example": "TenantPrincipal" }, "framework": { "type": [ "string", "null" ], "description": "You receive the associated framework slug, or null when the issuer is not tied to one.", "example": "acme-partner-framework-ypr5" }, "created_at": { "type": "string", "description": "You receive the timestamp when this trusted issuer was registered.", "example": "2026-07-02T23:33:35.153496+00:00", "format": "date-time" }, "validation_state": { "type": "string", "description": "You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.", "example": "unverified" }, "last_validated_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.", "example": null, "format": "date-time" } } }, "example": { "added_by": "TenantPrincipal", "created_at": "2026-07-02T23:51:58.727290+00:00", "did": "", "framework": "acme-partner-framework-y4bf", "id": "ef799a56-23dc-467d-9760-9fd20a8457fa", "iss": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "jwks_uri": "", "name": "Gov PID Issuer", "status": "disabled", "trust_anchor": "https-jwks" } } } }, "400": { "description": "Bad request \u2014 you attempted to edit the immutable `iss` field.", "content": { "application/json": { "schema": { "type": "object", "properties": { "iss": { "type": "string", "description": "You receive the reason the field cannot be edited.", "example": "Issuer URL cannot be edited. Delete and recreate the issuer instead." } } }, "example": { "iss": [ "Issuer URL cannot be edited. Delete and recreate the issuer instead." ] } } } } }, "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the trusted issuer registry entry to update.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You optionally set the trusted issuer display name.", "example": "Gov PID Issuer" }, "trust_anchor": { "type": "string", "description": "You optionally set the signing-key anchor type: `https-jwks`, `did-web`, or `x509`.", "example": "https-jwks" }, "jwks_uri": { "type": "string", "description": "You optionally set the JSON Web Key Set (JWKS) endpoint.", "example": "https://issuer.gov.example/.well-known/jwks.json", "format": "uri" }, "did": { "type": "string", "description": "You optionally set the decentralized identifier (DID) for the issuer.", "example": "" }, "framework": { "type": [ "string", "null" ], "description": "You optionally set (or clear with null) the trust framework slug this issuer belongs to.", "example": "acme-partner-framework-ypr5" }, "status": { "type": "string", "description": "You optionally set the trust-gate status: `active` or `disabled`.", "example": "disabled" } } }, "example": { "status": "disabled" } } } } } }, "/v1/trusted-issuers/{uuid}/validate": { "post": { "operationId": "v1_trusted_issuers_validate_create", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the trusted issuer registry entry to validate.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "Trust Registry" ], "responses": { "200": { "description": "The trusted issuer object with a validation result.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for the trusted issuer registry entry.", "example": "18d3239a-4a0e-412b-9487-17ce7dc3bb8e", "format": "uuid" }, "name": { "type": "string", "description": "You receive the trusted issuer display name.", "example": "Gov PID Issuer" }, "iss": { "type": "string", "description": "You receive the issuer identifier that credentials must match.", "example": "http://localhost:8011/v1/issuers/docs-external-issuer-9r79lx", "format": "uri" }, "trust_anchor": { "type": "string", "description": "You receive the signing-key anchor type. `https-jwks` resolves through a JSON Web Key Set (JWKS) endpoint when one is configured.", "example": "https-jwks" }, "jwks_uri": { "type": "string", "description": "You receive the JSON Web Key Set (JWKS) endpoint. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "did": { "type": "string", "description": "You receive the decentralized identifier for the issuer. The captured value is an empty string when the registry entry does not store one.", "example": "" }, "status": { "type": "string", "description": "You receive the trust-gate status for this issuer.", "example": "active" }, "added_by": { "type": "string", "description": "You receive the principal that registered this trusted issuer.", "example": "TenantPrincipal" }, "framework": { "type": [ "string", "null" ], "description": "You receive the associated framework slug, or null when the issuer is not tied to one.", "example": "acme-partner-framework-ypr5" }, "created_at": { "type": "string", "description": "You receive the timestamp when this trusted issuer was registered.", "example": "2026-07-02T23:33:35.153496+00:00", "format": "date-time" }, "validation": { "type": "object", "properties": { "reachable": { "type": "boolean", "description": "You receive `true` when Didit ID could reach the issuer trust anchor.", "example": true }, "anchor_ok": { "type": "boolean", "description": "You receive `true` when signing-key resolution against the trust anchor succeeded.", "example": true }, "issuer_matches": { "type": "boolean", "description": "You receive `true` when the resolved issuer metadata matches the registered `iss`.", "example": true }, "jwks_keys": { "type": "integer", "description": "You receive the number of keys discovered in the resolved JSON Web Key Set (JWKS).", "example": 2 }, "error": { "type": "string", "description": "You receive a human-readable error string when resolution fails, otherwise an empty string.", "example": "" }, "status": { "type": "string", "description": "You receive the registry status used during validation.", "example": "active" }, "validation_state": { "type": "string", "description": "You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.", "example": "unverified" } }, "description": "You receive the result of the live issuer-metadata resolution and trust-anchor check." }, "validation_state": { "type": "string", "description": "You receive the trust-anchor validation state: `unverified`, `verified`, or `failed`.", "example": "unverified" }, "last_validated_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent validation run, or null when the issuer has never been validated.", "example": null, "format": "date-time" } } }, "example": { "added_by": "TenantPrincipal", "created_at": "2026-07-02T23:51:58.727290+00:00", "did": "", "framework": "acme-partner-framework-y4bf", "id": "ef799a56-23dc-467d-9760-9fd20a8457fa", "iss": "http://localhost:8011/v1/issuers/docs-external-issuer-b2u6ty", "jwks_uri": "", "name": "Gov PID Issuer", "status": "active", "trust_anchor": "https-jwks", "validation": { "anchor_ok": true, "reachable": true, "status": "active" } } } } } }, "summary": "Validate a trusted issuer", "description": "Validate a trusted issuer's trust anchor. Didit ID checks reachability and key resolution. You can use the result before relying on a new or changed issuer.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/relying-parties": { "get": { "operationId": "v1_relying_parties_retrieve", "tags": [ "Trust Registry" ], "responses": { "200": { "description": "A bare JSON array of relying party objects for the caller's tenant.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "client_id": { "type": "string", "example": "", "description": "You receive the OpenID4VP (OpenID for Verifiable Presentations) client identifier. The value can be an empty string when you do not set one." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:58.746686+00:00", "description": "You receive the timestamp when this relying party was registered.", "format": "date-time" }, "id": { "type": "string", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "description": "You receive the UUID for this relying party registration.", "format": "uuid" }, "name": { "type": "string", "example": "Campus Door", "description": "You receive the relying party display name." }, "origin": { "type": "string", "example": "https://door.acme.example", "description": "You receive the registered web origin for this relying party.", "format": "uri" }, "status": { "type": "string", "example": "active", "description": "You receive the registration status for this relying party." }, "trust_policy": { "type": "string", "description": "You receive the trust policy for this relying party: `tenant` (inherit the tenant trust registry) or `custom` (per-relying-party trust rules).", "example": "tenant" } } } }, "example": [ { "client_id": "", "created_at": "2026-07-02T23:51:58.746686+00:00", "id": "44b2d61a-1634-486b-a35a-df26eb653a1a", "name": "Campus Door", "origin": "https://door.acme.example", "status": "active" }, { "client_id": "campus-door", "created_at": "2026-07-02T23:51:56.322685+00:00", "id": "00cd910f-834f-46ec-a1a6-5288d1da2cbc", "name": "Campus Door", "origin": "https://door.contoso.edu.example", "status": "active" }, { "client_id": "partner-portal", "created_at": "2026-07-02T23:51:56.322215+00:00", "id": "f2f5f0b5-5fdc-485b-bd90-f9cb68458b04", "name": "Partner Portal", "origin": "https://partners.globex.example", "status": "active" }, { "client_id": "gate-check", "created_at": "2026-07-02T23:51:56.321719+00:00", "id": "d19aa1b3-a36c-4faf-b538-5119395bb9f1", "name": "Gate Check RP", "origin": "https://gate.acme-air.example", "status": "active" } ] } } } }, "summary": "List relying parties", "description": "List relying parties registered under this tenant. Didit ID uses each origin when wallet presentation requests flow through the W3C Digital Credentials API. The response is a bare JSON array ordered by most recent creation time.", "security": [ { "bearerAuth": [] } ] }, "post": { "operationId": "v1_relying_parties_create", "tags": [ "Trust Registry" ], "responses": { "201": { "description": "The relying party was registered.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this relying party registration.", "example": "66c7a3cd-de20-43ea-b06d-2f0e7a49fa5d", "format": "uuid" }, "name": { "type": "string", "description": "You receive the relying party display name.", "example": "Campus Door" }, "origin": { "type": "string", "description": "You receive the registered web origin for this relying party.", "example": "https://door.acme.example", "format": "uri" }, "client_id": { "type": "string", "description": "You receive the OpenID4VP (OpenID for Verifiable Presentations) client identifier. The captured value is an empty string when you do not set one.", "example": "" }, "status": { "type": "string", "description": "You receive the registration status for this relying party.", "example": "active" }, "created_at": { "type": "string", "description": "You receive the timestamp when this relying party was registered.", "example": "2026-07-02T23:33:35.172947+00:00", "format": "date-time" }, "trust_policy": { "type": "string", "description": "You receive the trust policy for this relying party: `tenant` (inherit the tenant trust registry) or `custom` (per-relying-party trust rules).", "example": "tenant" } } }, "example": { "client_id": "", "created_at": "2026-07-02T23:51:58.746686+00:00", "id": "44b2d61a-1634-486b-a35a-df26eb653a1a", "name": "Campus Door", "origin": "https://door.acme.example", "status": "active" } } } } }, "summary": "Register a relying party", "description": "Register a relying party verifier origin for wallet presentation requests. Didit ID uses the origin when a request flows through the W3C Digital Credentials API. The new registration starts as active.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You set the relying party display name.", "example": "Campus Door" }, "origin": { "type": "string", "description": "You set the web origin for this relying party.", "example": "https://door.acme.example", "format": "uri" }, "client_id": { "type": "string", "description": "You optionally set the OpenID4VP (OpenID for Verifiable Presentations) client identifier.", "example": "campus-door" }, "trust_policy": { "type": "string", "description": "You optionally set the trust policy: `tenant` (default, inherit the tenant registry) or `custom` (per-relying-party trust rules).", "example": "tenant" } }, "required": [ "name", "origin" ] }, "example": { "name": "Campus Door", "origin": "https://door.acme.example" } } } } } }, "/v1/relying-parties/{uuid}": { "delete": { "operationId": "v1_relying_parties_destroy", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the relying party registration to remove.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "Trust Registry" ], "responses": { "204": { "description": "The relying party registration was removed. No response body is returned." } }, "summary": "Remove a relying party", "description": "Remove a relying party registration from this tenant. After removal, Didit ID no longer recognizes the verifier origin for registered-origin checks. A successful removal returns no response body.", "security": [ { "bearerAuth": [] } ] }, "patch": { "operationId": "patchRelyingPartiesUuid", "tags": [ "Trust Registry" ], "summary": "Update a relying party", "description": "Update a relying party's `name`, `origin`, `client_id`, `status` (`active` / `disabled`), or `trust_policy` (`tenant` / `custom`). Send only the fields you want to change.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the relying party registration to update.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You optionally set the relying party display name.", "example": "Campus Door" }, "origin": { "type": "string", "description": "You optionally set the registered web origin.", "example": "https://door.acme.example", "format": "uri" }, "client_id": { "type": "string", "description": "You optionally set the OpenID4VP client identifier.", "example": "campus-door" }, "status": { "type": "string", "description": "You optionally set the registration status: `active` or `disabled`.", "example": "disabled" }, "trust_policy": { "type": "string", "description": "You optionally set the trust policy: `tenant` or `custom`.", "example": "custom" } } }, "example": { "trust_policy": "custom" } } } }, "responses": { "200": { "description": "The relying party was updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this relying party registration.", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "format": "uuid" }, "name": { "type": "string", "description": "You receive the relying party display name.", "example": "Campus Door" }, "origin": { "type": "string", "description": "You receive the registered web origin.", "example": "https://door.acme.example", "format": "uri" }, "client_id": { "type": "string", "description": "You receive the OpenID4VP client identifier.", "example": "campus-door" }, "status": { "type": "string", "description": "You receive the registration status.", "example": "active" }, "trust_policy": { "type": "string", "description": "You receive the trust policy for this relying party: `tenant` (inherit the tenant trust registry) or `custom` (per-relying-party trust rules).", "example": "tenant" }, "created_at": { "type": "string", "description": "You receive the timestamp when this relying party was registered.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } }, "example": { "id": "44b2d61a-1634-486b-a35a-df26eb653a1a", "name": "Campus Door", "origin": "https://door.acme.example", "client_id": "campus-door", "status": "active", "trust_policy": "custom", "created_at": "2026-07-02T23:51:58.746686+00:00" } } } } } } }, "/v1/keys": { "get": { "operationId": "v1_keys_retrieve", "tags": [ "Issuer Keys" ], "responses": { "200": { "description": "You receive the tenant's signing keys and the JWKS (JSON Web Key Set) URI that verifiers use to discover public keys.", "content": { "application/json": { "schema": { "type": "object", "properties": { "keys": { "type": "array", "description": "Signing keys the tenant still publishes for verification. The list includes active and rotated keys, ordered newest first.", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Internal UUID of the signing-key record.", "example": "1fe53cd3-ec80-4a69-ab90-f217ddf5f6a2", "format": "uuid" }, "kid": { "type": "string", "description": "JWK (JSON Web Key) key identifier for the public signing key. The service places this `kid` in each SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header so verifiers can select the right public key.", "example": "9hStvT31-vXqUluU380kWkrTdInbdUf_4jh1-vooYks" }, "alg": { "type": "string", "description": "JSON Web Signature algorithm used by this key.", "example": "ES256", "enum": [ "ES256" ] }, "status": { "type": "string", "description": "Key lifecycle state. `active` signs new credentials. `rotated` verifies credentials signed before rotation.", "example": "active", "enum": [ "active", "rotated" ] }, "is_active": { "type": "boolean", "description": "Whether this key is the current signing key.", "example": true }, "valid_until": { "type": [ "string", "null" ], "description": "Timestamp until which a rotated key remains valid for verification. Active keys return null.", "example": null, "format": "date-time" }, "created_at": { "type": "string", "description": "Timestamp when the signing key was created.", "example": "2026-07-02T23:33:32.141586+00:00", "format": "date-time" } } } }, "jwks_uri": { "type": "string", "description": "Absolute JWKS (JSON Web Key Set) discovery URL for this tenant. The document exposes public JWK (JSON Web Key) values for active and rotated keys.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6/.well-known/jwt-vc-issuer", "format": "uri" } } }, "example": { "jwks_uri": "http://localhost:8011/v1/issuers/docs-capture-z2373a/.well-known/jwt-vc-issuer", "keys": [ { "alg": "ES256", "created_at": "2026-07-02T23:51:56.317195+00:00", "id": "1cd08abb-eb0e-470e-af0d-771014596793", "is_active": true, "kid": "DgJ8yLHSJHxiSzbaJvRRUZfHYoyGxOEfhj4pCdslUCY", "status": "active", "valid_until": null }, { "alg": "ES256", "created_at": "2026-07-02T23:51:56.316117+00:00", "id": "fc53b01e-4be2-469c-a654-25d807b9b78a", "is_active": false, "kid": "Q07LPcci9DgrqA7ZUiXprqzJkmG-z9GsS2EZnQj_Hg8", "status": "rotated", "valid_until": "2027-07-02T23:51:56.316743+00:00" } ] } } } } }, "summary": "List issuer signing keys", "description": "List your issuer signing keys and the JWKS (JSON Web Key Set) discovery URI. You use this endpoint to inspect active and rotated keys before or after a rotation. The service creates an active signing key on first use when none exists.", "security": [ { "bearerAuth": [] } ] } }, "/v1/keys/rotate": { "post": { "operationId": "v1_keys_rotate_create", "tags": [ "Issuer Keys" ], "responses": { "201": { "description": "The rotation result, including the new key, the rotated key, the requested overlap window, and the impact summary.", "content": { "application/json": { "schema": { "type": "object", "properties": { "new_key": { "type": "object", "description": "The new signing key. The service uses this key to sign credentials after rotation.", "properties": { "id": { "type": "string", "description": "Internal UUID of the new signing-key record.", "example": "44bb118a-e72f-4253-9310-c9bc95532939", "format": "uuid" }, "kid": { "type": "string", "description": "JWK (JSON Web Key) key identifier for the new active key. Credentials issued after rotation carry this `kid` in their SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header.", "example": "qE8_bhAhCpu2jelDn-5shSVfqK2mFbIekiU5TOMSmyY" }, "alg": { "type": "string", "description": "JSON Web Signature algorithm used by the new key.", "example": "ES256", "enum": [ "ES256" ] }, "status": { "type": "string", "description": "Lifecycle state of the new key after rotation.", "example": "active", "enum": [ "active" ] }, "is_active": { "type": "boolean", "description": "Whether this key is the current signing key.", "example": true }, "valid_until": { "type": [ "string", "null" ], "description": "Validity expiry for the key. The active key returns null.", "example": null, "format": "date-time" }, "created_at": { "type": "string", "description": "Timestamp when the new key was created.", "example": "2026-07-02T23:33:35.126426+00:00", "format": "date-time" } } }, "rotated_key": { "type": "object", "description": "The previous active signing key after the service demotes it to `rotated`. Credentials already signed by this key keep verifying until `valid_until`.", "properties": { "id": { "type": "string", "description": "Internal UUID of the rotated signing-key record.", "example": "35933909-a210-48c8-8d7d-100835f6ae2a", "format": "uuid" }, "kid": { "type": "string", "description": "JWK (JSON Web Key) key identifier for the rotated key. Credentials signed before rotation carry this `kid` in their SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header.", "example": "GTb08xmXDpoEobZao92elfENa0t2xHnlwMR3_DtxfBQ" }, "alg": { "type": "string", "description": "JSON Web Signature algorithm used by the rotated key.", "example": "ES256", "enum": [ "ES256" ] }, "status": { "type": "string", "description": "Lifecycle state of the previous active key after rotation.", "example": "rotated", "enum": [ "rotated" ] }, "is_active": { "type": "boolean", "description": "Whether this key is the current signing key.", "example": false }, "valid_until": { "type": "string", "description": "Timestamp until which the rotated key remains valid for verification.", "example": "2026-07-09T23:33:35.125939+00:00", "format": "date-time" }, "created_at": { "type": "string", "description": "Timestamp when the rotated key was created.", "example": "2026-07-02T23:33:35.032732+00:00", "format": "date-time" } } }, "overlap_days": { "type": "integer", "description": "Number of days the rotated key remains valid for credentials signed before rotation.", "example": 7 }, "impact": { "type": "object", "description": "Summary of how the rotation affects credentials already signed by the previous key.", "properties": { "credentials_under_previous_key": { "type": "integer", "description": "Count of credentials signed by the previous key when you rotated it.", "example": 24 }, "note": { "type": "string", "description": "Human-readable explanation of the overlap window after rotation.", "example": "Existing credentials keep verifying under the rotated key for 7 days (overlapping validity); new credentials sign with the new key immediately." } } } } }, "example": { "impact": { "credentials_under_previous_key": 24, "note": "Existing credentials keep verifying under the rotated key for 7 days (overlapping validity); new credentials sign with the new key immediately." }, "new_key": { "alg": "ES256", "created_at": "2026-07-02T23:51:58.700242+00:00", "id": "3daad7e7-5ba6-4cba-b950-9dc93fe774fc", "is_active": true, "kid": "ZN9Bx4TFcfMO-f8eJkeURheDnapmjk4noTjHS7p_eA4", "status": "active", "valid_until": null }, "overlap_days": 7, "rotated_key": { "alg": "ES256", "created_at": "2026-07-02T23:51:58.601175+00:00", "id": "edfa643d-f84c-4338-be20-b09aebb7a17a", "is_active": false, "kid": "EFAu2SYIrvBBB8Xm7zIeLOj67SCLqlCBk4kSnUYtnM4", "status": "rotated", "valid_until": "2026-07-09T23:51:58.699746+00:00" } } } } } }, "summary": "Rotate the issuer signing key", "description": "Rotate your issuer signing key. You can send `overlap_days` to choose how long credentials signed by the previous key keep verifying. New credentials use the new active key immediately.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "overlap_days": { "type": "integer", "description": "Number of days the previous key remains valid after rotation. Use this to control the overlap window for credentials already signed by that key.", "example": 7 } } }, "example": { "overlap_days": 7 } } } } } }, "/v1/keys/impact": { "get": { "operationId": "v1_keys_impact_retrieve", "tags": [ "Issuer Keys" ], "responses": { "200": { "description": "The rotation-impact preview for the tenant.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credentials_under_active_key": { "type": "integer", "description": "Count of credentials signed by the active key before rotation.", "example": 28 }, "default_overlap_days": { "type": "integer", "description": "Default number of days the service keeps the rotated key trusted when you do not provide `overlap_days`.", "example": 365 }, "note": { "type": "string", "description": "Human-readable explanation of the overlap behavior.", "example": "These credentials would continue to verify under the current key after rotation (overlapping validity)." } } }, "example": { "credentials_under_active_key": 28, "default_overlap_days": 365, "note": "These credentials would continue to verify under the current key after rotation (overlapping validity)." } } } } }, "summary": "Key-rotation impact (credentials under current key)", "description": "Preview how many issued credentials use the active key before you rotate it. You use this endpoint to decide whether the default overlap window is acceptable.", "security": [ { "bearerAuth": [] } ] } }, "/v1/credential-offers": { "get": { "operationId": "v1_credential_offers_retrieve", "description": "List credential offers for your tenant. The response is a bare JSON array, so each documented field describes one offer object in that array. Use it to track pending and claimed OpenID4VCI (OpenID for Verifiable Credential Issuance) offers.", "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "A bare JSON array of credential offer objects.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "claimed_at": { "type": [ "string", "null" ], "example": null, "description": "You receive the timestamp when the holder claimed the offer. You receive null while the offer is still pending.", "format": "date-time" }, "claimed_by": { "type": "string", "example": "", "description": "You receive the holder identifier that claimed the offer. You receive an empty string until a holder claims it." }, "created_at": { "type": "string", "example": "2026-07-02T23:51:57.514393+00:00", "description": "You receive the timestamp when Didit created the offer.", "format": "date-time" }, "email_sent_at": { "type": [ "string", "null" ], "example": null, "description": "You receive the timestamp when Didit sent the claim email. You receive null when no email has been sent.", "format": "date-time" }, "expires_at": { "type": "string", "example": "2026-07-03T00:01:57.514340+00:00", "description": "You receive the timestamp when the offer expires.", "format": "date-time" }, "offer_id": { "type": "string", "example": "6ba6f012-900b-4cfa-8c3b-50498c90c640", "description": "Use this UUID to fetch, accept, or resend the credential offer.", "format": "uuid" }, "recipient_email": { "type": "string", "example": "holder@diditcapture.dev", "description": "You receive the email address associated with the offer. You receive an empty string when the offer has no email recipient." }, "schema_name": { "type": "string", "example": "Loyalty Membership", "description": "You receive the credential schema display name used by this offer." }, "status": { "type": "string", "example": "pending", "description": "You receive the current offer status." }, "tx_code_required": { "type": "boolean", "example": true, "description": "You receive true when the holder must enter a transaction code before issuance." }, "vct": { "type": "string", "example": "AirlineLoyalty", "description": "You receive the VCT (Verifiable Credential Type) that this offer issues." } } } }, "example": [ { "claimed_at": null, "claimed_by": "", "created_at": "2026-07-02T23:51:57.514393+00:00", "email_sent_at": null, "expires_at": "2026-07-03T00:01:57.514340+00:00", "offer_id": "6ba6f012-900b-4cfa-8c3b-50498c90c640", "recipient_email": "holder@diditcapture.dev", "schema_name": "Loyalty Membership", "status": "pending", "tx_code_required": true, "vct": "AirlineLoyalty" }, { "claimed_at": null, "claimed_by": "", "created_at": "2026-07-02T23:51:57.511172+00:00", "email_sent_at": null, "expires_at": "2026-07-03T00:01:57.511106+00:00", "offer_id": "e6233586-9a63-459a-b799-a0500f97d577", "recipient_email": "", "schema_name": "Loyalty Membership", "status": "pending", "tx_code_required": true, "vct": "AirlineLoyalty" } ] } } } }, "security": [ { "bearerAuth": [] } ], "summary": "List the tenant's credential offers." }, "post": { "operationId": "v1_credential_offers_create", "description": "Create an OpenID4VCI (OpenID for Verifiable Credential Issuance) credential offer from one of your templates. You provide captured claim values, and Didit returns the claim URL, the wallet deep link, and the pre-authorized grant data. Send the returned transaction code to the holder through your own channel when the offer requires one.", "tags": [ "OpenID4VCI Protocol" ], "responses": { "201": { "description": "Didit created the credential offer and returned the claim links and grant data.", "content": { "application/json": { "schema": { "type": "object", "properties": { "claim_url": { "type": "string", "description": "Send this web claim URL to the holder when you use Didit's hosted claim flow.", "example": "http://localhost:3012/claim?offer=f7219265-039a-4c72-b2bd-54432bf443b3", "format": "uri" }, "credential_issuer": { "type": "string", "description": "Use this issuer identifier as the OpenID4VCI (OpenID for Verifiable Credential Issuance) credential issuer.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "credential_offer_uri": { "type": "string", "description": "Encode this OpenID4VCI (OpenID for Verifiable Credential Issuance) credential-offer URI as a QR code or wallet deep link.", "example": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Ff7219265-039a-4c72-b2bd-54432bf443b3%2Foffer", "format": "uri" }, "email_sent": { "type": "boolean", "description": "You receive true when Didit sent the claim email during offer creation.", "example": false }, "expires_at": { "type": "string", "description": "You receive the timestamp when this offer expires.", "example": "2026-07-02T23:43:33.649962+00:00", "format": "date-time" }, "grants": { "type": "object", "description": "Pass this OpenID4VCI (OpenID for Verifiable Credential Issuance) grants object to the wallet. It contains the pre-authorized code grant.", "example": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "pre-authorized_code": "" } }, "properties": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "type": "object", "description": "Use this grant object when the wallet exchanges the pre-authorized code for an issuance access token.", "example": { "pre-authorized_code": "" }, "properties": { "pre-authorized_code": { "type": "string", "description": "Send this code to the token endpoint as `pre-authorized_code`.", "example": "" } } } } }, "offer_id": { "type": "string", "description": "Use this UUID to fetch, accept, or resend the credential offer.", "example": "f7219265-039a-4c72-b2bd-54432bf443b3", "format": "uuid" }, "pre_authorized_code": { "type": "string", "description": "You receive the pre-authorized code as a top-level convenience field.", "example": "" }, "recipient_email": { "type": "string", "description": "You receive the email recipient configured for the offer. You receive an empty string when no recipient email was set.", "example": "" }, "tx_code": { "type": "string", "description": "Send this transaction code to the holder through an out-of-band channel.", "example": "" } } }, "example": { "claim_url": "http://localhost:3012/claim?offer=e6233586-9a63-459a-b799-a0500f97d577", "credential_issuer": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "credential_offer_uri": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Fe6233586-9a63-459a-b799-a0500f97d577%2Foffer", "email_sent": false, "expires_at": "2026-07-03T00:01:57.511106+00:00", "grants": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "pre-authorized_code": "" } }, "offer_id": "e6233586-9a63-459a-b799-a0500f97d577", "pre_authorized_code": "", "recipient_email": "", "tx_code": "" } } } }, "404": { "description": "No template with `template_id` exists for the caller's tenant (or it is soft-deleted).", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Human-readable not-found message.", "example": "Not found." } } } } } } }, "summary": "Create a credential offer", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "claims": { "type": "object", "description": "Send claim values keyed by the schema attribute name. This captured request includes `given_name` and `tier`.", "example": { "given_name": "Ada", "tier": "gold" }, "properties": { "given_name": { "type": "string", "description": "Send the holder's given name when your template includes this claim.", "example": "Ada" }, "tier": { "type": "string", "description": "Send the membership tier when your template includes this claim.", "example": "gold" } } }, "template_id": { "type": "string", "description": "Send the UUID of the credential template you want to issue from.", "example": "5588f83f-620b-4614-8ffa-933634a0b708", "format": "uuid" } }, "required": [ "template_id" ] }, "example": { "claims": { "given_name": "Ada", "tier": "gold" }, "template_id": "b18c99cb-5b7b-4915-938c-038c2ddefb6f" } } } } } }, "/v1/credential-offers/resolve": { "get": { "operationId": "v1_credential_offers_resolve_retrieve", "description": "Resolve an OpenID4VCI (OpenID for Verifiable Credential Issuance) credential offer by tenant and pre-authorized code. Use this endpoint to render a wallet claim screen before the holder exchanges the code. The response shows labels only for claims in this captured flow.", "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit resolved the offer for the wallet claim screen.", "content": { "application/json": { "schema": { "type": "object", "properties": { "claims": { "type": "array", "description": "You receive the claims the wallet can show before issuance.", "example": [ { "label": "Given Name", "name": "given_name", "selective_disclosure": true }, { "label": "Tier", "name": "tier", "selective_disclosure": true } ], "items": { "type": "object", "properties": { "label": { "type": "string", "description": "Show this human-readable claim label to the holder.", "example": "Given Name" }, "name": { "type": "string", "description": "Use this machine-readable claim name to identify the attribute.", "example": "given_name" }, "selective_disclosure": { "type": "boolean", "description": "You receive true when the holder can selectively disclose this claim later.", "example": true } } } }, "expires_at": { "type": "string", "description": "You receive the timestamp when the offer expires.", "example": "2026-07-02T23:43:33.649962+00:00", "format": "date-time" }, "format": { "type": "string", "description": "You receive the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format value for this offer.", "example": "SD_JWT_VC" }, "issuer": { "type": "object", "description": "Use this issuer identity block to render the claim screen.", "example": { "did": "did:web:docs-capture-6clew6.didit.test", "domain": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "id": "docs-capture-6clew6", "name": "docs-capture-6clew6" }, "properties": { "did": { "type": "string", "description": "Show this decentralized identifier for the issuer.", "example": "did:web:docs-capture-6clew6.didit.test" }, "domain": { "type": "string", "description": "Use this issuer URL as the credential issuer identifier.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "id": { "type": "string", "description": "Use this tenant slug to identify the issuer.", "example": "docs-capture-6clew6" }, "name": { "type": "string", "description": "Show this issuer display name to the holder.", "example": "docs-capture-6clew6" } } }, "offer_id": { "type": "string", "description": "Use this UUID to identify the resolved credential offer.", "example": "f7219265-039a-4c72-b2bd-54432bf443b3", "format": "uuid" }, "offer_uri": { "type": "string", "description": "Open this OpenID4VCI (OpenID for Verifiable Credential Issuance) credential-offer URI in a compatible wallet.", "example": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Ff7219265-039a-4c72-b2bd-54432bf443b3%2Foffer", "format": "uri" }, "tx_code_length": { "type": "integer", "description": "Render a transaction-code input with this many digits.", "example": 6 }, "tx_code_required": { "type": "boolean", "description": "You receive true when the holder must enter a transaction code.", "example": true }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) that this offer issues.", "example": "AirlineLoyalty" } } }, "example": { "claims": [ { "label": "Given Name", "name": "given_name", "selective_disclosure": true }, { "label": "Tier", "name": "tier", "selective_disclosure": true } ], "expires_at": "2026-07-03T00:01:57.511106+00:00", "format": "SD_JWT_VC", "issuer": { "did": "did:web:docs-capture-z2373a.didit.test", "domain": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "id": "docs-capture-z2373a", "name": "docs-capture-z2373a" }, "offer_id": "e6233586-9a63-459a-b799-a0500f97d577", "offer_uri": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Fe6233586-9a63-459a-b799-a0500f97d577%2Foffer", "tx_code_length": 6, "tx_code_required": true, "vct": "AirlineLoyalty" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Resolve an offer by (tenant, pre-authorized code) for the wallet claim screen.", "parameters": [ { "name": "code", "in": "query", "required": false, "description": "Send the pre-authorized code from the credential offer URI.", "schema": { "type": "string" } }, { "name": "tenant", "in": "query", "required": false, "description": "Send the tenant slug that issued the offer.", "schema": { "type": "string" } } ] } }, "/v1/credential-offers/{uuid}": { "get": { "operationId": "v1_credential_offers_retrieve_2", "description": "Fetch a public preview of an OpenID4VCI (OpenID for Verifiable Credential Issuance) credential offer by UUID. Use it to show the issuer, credential type, expiration, transaction-code requirement, and claim labels. This captured flow returns labels without claim values.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Send the offer UUID.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit returned the holder-facing offer preview.", "content": { "application/json": { "schema": { "type": "object", "properties": { "claims": { "type": "array", "description": "You receive the claims the wallet can show before issuance.", "example": [ { "label": "Given Name", "name": "given_name", "selective_disclosure": true }, { "label": "Tier", "name": "tier", "selective_disclosure": true } ], "items": { "type": "object", "properties": { "label": { "type": "string", "description": "Show this human-readable claim label to the holder.", "example": "Given Name" }, "name": { "type": "string", "description": "Use this machine-readable claim name to identify the attribute.", "example": "given_name" }, "selective_disclosure": { "type": "boolean", "description": "You receive true when the holder can selectively disclose this claim later.", "example": true } } } }, "expires_at": { "type": "string", "description": "You receive the timestamp when the offer expires.", "example": "2026-07-02T23:43:33.649962+00:00", "format": "date-time" }, "format": { "type": "string", "description": "You receive the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format value for this offer.", "example": "SD_JWT_VC" }, "issuer": { "type": "object", "description": "Use this issuer identity block to render the claim screen.", "example": { "did": "did:web:docs-capture-6clew6.didit.test", "domain": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "id": "docs-capture-6clew6", "name": "docs-capture-6clew6" }, "properties": { "did": { "type": "string", "description": "Show this decentralized identifier for the issuer.", "example": "did:web:docs-capture-6clew6.didit.test" }, "domain": { "type": "string", "description": "Use this issuer URL as the credential issuer identifier.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "id": { "type": "string", "description": "Use this tenant slug to identify the issuer.", "example": "docs-capture-6clew6" }, "name": { "type": "string", "description": "Show this issuer display name to the holder.", "example": "docs-capture-6clew6" } } }, "offer_id": { "type": "string", "description": "Use this UUID to identify the credential offer.", "example": "f7219265-039a-4c72-b2bd-54432bf443b3", "format": "uuid" }, "offer_uri": { "type": "string", "description": "Open this OpenID4VCI (OpenID for Verifiable Credential Issuance) credential-offer URI in a compatible wallet.", "example": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Ff7219265-039a-4c72-b2bd-54432bf443b3%2Foffer", "format": "uri" }, "tx_code_length": { "type": "integer", "description": "Render a transaction-code input with this many digits.", "example": 6 }, "tx_code_required": { "type": "boolean", "description": "You receive true when the holder must enter a transaction code.", "example": true }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) that this offer issues.", "example": "AirlineLoyalty" } } }, "example": { "claims": [ { "label": "Given Name", "name": "given_name", "selective_disclosure": true }, { "label": "Tier", "name": "tier", "selective_disclosure": true } ], "expires_at": "2026-07-03T00:01:57.511106+00:00", "format": "SD_JWT_VC", "issuer": { "did": "did:web:docs-capture-z2373a.didit.test", "domain": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "id": "docs-capture-z2373a", "name": "docs-capture-z2373a" }, "offer_id": "e6233586-9a63-459a-b799-a0500f97d577", "offer_uri": "openid-credential-offer://?credential_offer_uri=http%3A%2F%2Flocalhost%3A8011%2Fv1%2Fcredential-offers%2Fe6233586-9a63-459a-b799-a0500f97d577%2Foffer", "tx_code_length": 6, "tx_code_required": true, "vct": "AirlineLoyalty" } } } }, "404": { "description": "No offer exists for the given UUID (or it is soft-deleted).", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Human-readable not-found message.", "example": "Not found." } } } } } } }, "summary": "Get a credential offer (holder preview)", "security": [] } }, "/v1/credential-offers/{uuid}/offer": { "get": { "operationId": "v1_credential_offers_offer_retrieve", "description": "Fetch the OpenID4VCI (OpenID for Verifiable Credential Issuance) credential-offer-by-reference document. Wallets open the `credential_offer_uri`, fetch this document, and then exchange the pre-authorized code at the token endpoint. This response follows the standard credential offer shape.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Send the offer UUID.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit returned the OpenID4VCI credential-offer document.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential_configuration_ids": { "type": "array", "description": "Use these credential configuration IDs to select the offered VCT (Verifiable Credential Type).", "example": [ "AirlineLoyalty" ], "items": { "type": "string", "description": "A credential configuration ID from the issuer metadata.", "example": "AirlineLoyalty" } }, "credential_issuer": { "type": "string", "description": "Use this issuer identifier to discover metadata and validate the proof audience.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "grants": { "type": "object", "description": "Use this grants object to drive the token request.", "example": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "pre-authorized_code": "", "tx_code": { "description": "", "input_mode": "", "length": 6 } } }, "properties": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "type": "object", "description": "Use this pre-authorized code grant when you request an issuance access token.", "example": { "pre-authorized_code": "", "tx_code": { "description": "", "input_mode": "", "length": 6 } }, "properties": { "pre-authorized_code": { "type": "string", "description": "Send this value to `POST /v1/oauth/token` as `pre-authorized_code`.", "example": "" }, "tx_code": { "type": "object", "description": "Use this transaction-code metadata to render the holder input.", "example": { "description": "", "input_mode": "", "length": 6 }, "properties": { "description": { "type": "string", "description": "Show this transaction-code instruction to the holder.", "example": "" }, "input_mode": { "type": "string", "description": "Use this value to choose the holder input mode.", "example": "" }, "length": { "type": "integer", "description": "Render a transaction-code input with this many digits.", "example": 6 } } } } } } } } }, "example": { "credential_configuration_ids": [ "AirlineLoyalty" ], "credential_issuer": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "grants": { "urn:ietf:params:oauth:grant-type:pre-authorized_code": { "pre-authorized_code": "", "tx_code": { "description": "", "input_mode": "", "length": 6 } } } } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Standard OpenID4VCI credential-offer-by-reference document." } }, "/v1/credential-offers/{uuid}/accept": { "post": { "operationId": "v1_credential_offers_accept_create", "description": "Accept a credential offer through Didit's server-side demo shortcut. Didit redeems the OpenID4VCI (OpenID for Verifiable Credential Issuance) offer, creates a holder key, and returns the issued SD-JWT VC (Selective-Disclosure JWT Verifiable Credential). Use this only for demo flows where the server accepts the offer for the holder.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Send the offer UUID.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit accepted the offer and minted the credential.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential": { "type": "object", "description": "You receive the issued credential expanded for the holder UI.", "example": { "claims": [ { "label": "", "name": "", "selective_disclosure": true, "value": "" }, { "label": "", "name": "", "selective_disclosure": true, "value": "" } ], "credential_name": "", "expires_at": "", "format": "", "id": "", "issued_at": "", "issuer": { "did": "", "domain": "", "id": "", "name": "" }, "sd_jwt": "", "status": "", "subject": "", "vct": "" }, "properties": { "claims": { "type": "array", "description": "You receive the claims embedded in the issued credential.", "example": [ { "label": "", "name": "", "selective_disclosure": true, "value": "" }, { "label": "", "name": "", "selective_disclosure": true, "value": "" } ], "items": { "type": "object", "properties": { "label": { "type": "string", "description": "Show this claim label to the holder.", "example": "" }, "name": { "type": "string", "description": "Use this machine-readable claim name to identify the attribute.", "example": "" }, "selective_disclosure": { "type": "boolean", "description": "You receive true when the holder can selectively disclose this claim later.", "example": true }, "value": { "type": "string", "description": "You receive the claim value included in the credential.", "example": "" } } } }, "credential_name": { "type": "string", "description": "Show this credential display name to the holder.", "example": "" }, "expires_at": { "type": "string", "description": "You receive the credential expiration timestamp.", "example": "" }, "format": { "type": "string", "description": "You receive the credential format value.", "example": "" }, "id": { "type": "string", "description": "Use this identifier for the issued credential record.", "example": "" }, "issued_at": { "type": "string", "description": "You receive the credential issuance timestamp.", "example": "" }, "issuer": { "type": "object", "description": "Use this issuer identity block to render the credential.", "example": { "did": "", "domain": "", "id": "", "name": "" }, "properties": { "did": { "type": "string", "description": "Show this decentralized identifier for the issuer.", "example": "" }, "domain": { "type": "string", "description": "Use this issuer domain as the credential issuer identifier.", "example": "" }, "id": { "type": "string", "description": "Use this tenant identifier for the issuer.", "example": "" }, "name": { "type": "string", "description": "Show this issuer display name to the holder.", "example": "" } } }, "sd_jwt": { "type": "string", "description": "Store this SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) string in the holder wallet.", "example": "" }, "status": { "type": "string", "description": "You receive the issued credential status.", "example": "" }, "subject": { "type": "string", "description": "Show this credential subject value to the holder.", "example": "" }, "vct": { "type": "string", "description": "You receive the credential VCT (Verifiable Credential Type).", "example": "" } } }, "holder_jwk": { "type": "object", "description": "You receive the public JWK (JSON Web Key) that Didit generated for this demo holder flow.", "example": { "crv": "P-256", "kty": "EC", "x": "gAKpvhAnew8YslTtTF7YdOp8LQEgyV4kaR5a7nSe6YE", "y": "wG9wk6df7491AtKC9F13X9nvhAwigohTd5nJC7PPrR0" }, "properties": { "crv": { "type": "string", "description": "You receive the elliptic curve name for the holder key.", "example": "P-256" }, "kty": { "type": "string", "description": "You receive the JWK (JSON Web Key) key type.", "example": "EC" }, "x": { "type": "string", "description": "You receive the x-coordinate of the public key.", "example": "gAKpvhAnew8YslTtTF7YdOp8LQEgyV4kaR5a7nSe6YE" }, "y": { "type": "string", "description": "You receive the y-coordinate of the public key.", "example": "wG9wk6df7491AtKC9F13X9nvhAwigohTd5nJC7PPrR0" } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) as a top-level convenience field.", "example": "AirlineLoyalty" } } }, "example": { "credential": { "claims": [ { "label": "", "name": "", "selective_disclosure": true, "value": "" }, { "label": "", "name": "", "selective_disclosure": true, "value": "" } ], "credential_name": "", "expires_at": "", "format": "", "id": "", "issued_at": "", "issuer": { "did": "", "domain": "", "id": "", "name": "" }, "sd_jwt": "", "status": "", "subject": "", "vct": "" }, "holder_jwk": { "crv": "P-256", "kty": "EC", "x": "XhoOXR1CgeFdeSw8M6MF3sfCcGVuLMENv3T9eBU3WFs", "y": "XMADS5elXCUDOkf-sTCbo6mUtegEwk9vq1axIE9R2nI" }, "vct": "AirlineLoyalty" } } } }, "400": { "description": "The flow could not complete \u2014 e.g. the offer was already redeemed, expired, or a tx_code/proof step failed.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "Human-readable failure reason. Examples: `offer already redeemed`, `offer expired`, `invalid tx_code`.", "example": "offer already redeemed" } } } } } }, "404": { "description": "No offer exists for the given UUID (or it is soft-deleted).", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Human-readable not-found message.", "example": "Not found." } } } } } } }, "summary": "Accept an offer (demo: server-side PoP)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/credential-offers/{uuid}/resend-email": { "post": { "operationId": "v1_credential_offers_resend_email_create", "description": "Resend the claim email for a pending credential offer. Use this when the offer has a recipient email and the holder needs a fresh delivery. The response returns the updated delivery state.", "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "Send the offer UUID.", "schema": { "type": "string", "format": "uuid" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit resent the claim email and returned the offer delivery state.", "content": { "application/json": { "schema": { "type": "object", "properties": { "claim_url": { "type": "string", "description": "Send this web claim URL to the holder when you use Didit's hosted claim flow.", "example": "http://localhost:3012/claim?offer=2c5fadb7-29cf-4005-a80d-7feb56719127", "format": "uri" }, "email_send_count": { "type": "integer", "description": "You receive the number of claim emails Didit has sent for this offer.", "example": 1 }, "email_sent": { "type": "boolean", "description": "You receive true when Didit sent the claim email.", "example": true }, "expires_at": { "type": "string", "description": "You receive the updated timestamp when the offer expires.", "example": "2026-07-09T23:33:33.665968+00:00", "format": "date-time" }, "offer_id": { "type": "string", "description": "Use this UUID to identify the credential offer.", "example": "2c5fadb7-29cf-4005-a80d-7feb56719127", "format": "uuid" }, "recipient_email": { "type": "string", "description": "You receive the email address that Didit sent the claim link to.", "example": "holder@diditcapture.dev" } } }, "example": { "claim_url": "http://localhost:3012/claim?offer=6ba6f012-900b-4cfa-8c3b-50498c90c640", "email_send_count": 1, "email_sent": true, "expires_at": "2026-07-09T23:51:57.526712+00:00", "offer_id": "6ba6f012-900b-4cfa-8c3b-50498c90c640", "recipient_email": "holder@diditcapture.dev" } } } } }, "security": [ { "bearerAuth": [] } ], "summary": "Re-send the claim email for a pending email-delivery offer.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/oauth/token": { "post": { "operationId": "v1_oauth_token_create", "description": "Exchange an OpenID4VCI (OpenID for Verifiable Credential Issuance) pre-authorized code for an issuance access token. Send the transaction code when the offer requires one. Use the returned token at the credential endpoint.", "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit issued a short-lived access token for credential issuance.", "content": { "application/json": { "schema": { "type": "object", "properties": { "access_token": { "type": "string", "description": "Send this token as the bearer token when you call the credential endpoint.", "example": "" }, "expires_in": { "type": "integer", "description": "You receive the access-token lifetime in seconds.", "example": 300 }, "token_type": { "type": "string", "description": "You receive the token type for the access token.", "example": "Bearer" } } }, "example": { "access_token": "", "expires_in": 300, "token_type": "Bearer" } } } }, "400": { "description": "Grant rejected \u2014 unsupported grant_type, or an invalid/expired/already-redeemed pre-authorized_code, or a wrong/exceeded tx_code.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "OAuth error code. `unsupported_grant_type` when `grant_type` is not the pre-authorized_code URN; `invalid_grant` for any code/tx_code failure.", "example": "invalid_grant" }, "error_description": { "type": "string", "description": "Human-readable reason. Present on `invalid_grant` responses. Typical values: `invalid pre-authorized_code`, `offer already redeemed`, `offer expired`, `invalid tx_code`, `tx_code attempts exceeded`.", "example": "invalid tx_code" } } } } } } }, "summary": "Token endpoint (pre-authorized_code grant)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "grant_type": { "type": "string", "description": "Send the pre-authorized code grant type.", "example": "urn:ietf:params:oauth:grant-type:pre-authorized_code" }, "pre-authorized_code": { "type": "string", "description": "Send the pre-authorized code from the credential offer.", "example": "" }, "tx_code": { "type": "string", "description": "Send the transaction code when the credential offer requires one.", "example": "" } }, "required": [ "grant_type", "pre-authorized_code" ] }, "example": { "grant_type": "urn:ietf:params:oauth:grant-type:pre-authorized_code", "pre-authorized_code": "", "tx_code": "" } } } } } }, "/v1/nonce": { "post": { "operationId": "v1_nonce_create", "description": "Mint a nonce for the OpenID4VCI (OpenID for Verifiable Credential Issuance) holder proof. Use the returned `c_nonce` inside the proof you send to the credential endpoint. The capture shows a 60-second nonce lifetime.", "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit minted a single-use challenge nonce.", "content": { "application/json": { "schema": { "type": "object", "properties": { "c_nonce": { "type": "string", "description": "Put this challenge nonce in the holder proof.", "example": "" }, "c_nonce_expires_in": { "type": "integer", "description": "You receive the nonce lifetime in seconds.", "example": 60 } } }, "example": { "c_nonce": "", "c_nonce_expires_in": 60 } } } } }, "summary": "Issue a c_nonce for the credential proof", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/credential": { "post": { "operationId": "v1_credential_create", "description": "Redeem an issuance access token and holder proof for an SD-JWT VC (Selective-Disclosure JWT Verifiable Credential). Send the proof generated by the holder wallet after you mint a nonce. Didit returns the issued credential and its VCT (Verifiable Credential Type).", "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit issued the credential.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential": { "type": "string", "description": "Store this issued SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) string in the holder wallet.", "example": "" }, "credentials": { "type": "array", "description": "You receive the issued credentials array for wallet-compatible clients.", "example": [ { "credential": "" } ], "items": { "type": "object", "properties": { "credential": { "type": "string", "description": "Store this issued credential string in the holder wallet.", "example": "" } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) of the issued credential.", "example": "AirlineLoyalty" } } }, "example": { "credential": "", "credentials": [ { "credential": "" } ], "vct": "AirlineLoyalty" } } } }, "400": { "description": "Missing or invalid proof (no `proof.jwt`, expired/invalid access token, expired/consumed c_nonce, malformed proof payload, bad key binding, or wrong audience).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "Error code. Always `invalid_proof` for proof/token/nonce failures.", "example": "invalid_proof" }, "error_description": { "type": "string", "description": "Human-readable reason. Examples: `missing proof.jwt`, `invalid access token`, `access token already used`, `access token expired`, `invalid or expired c_nonce`, `malformed proof payload`.", "example": "invalid or expired c_nonce" } } } } } }, "401": { "description": "Unauthorized \u2014 a valid tenant API key (Bearer) was not supplied. (Example: invalid issuance access token.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "You receive the error code for the failed credential request.", "example": "invalid_token" }, "error_description": { "type": "string", "description": "You receive the reason Didit rejected the access token.", "example": "invalid access token" } } }, "example": { "error": "invalid_token", "error_description": "invalid access token" } } } } }, "summary": "Credential endpoint (holder proof-of-possession \u2192 SD-JWT VC)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "proof": { "type": "object", "description": "Send the holder proof object that binds issuance to the holder key.", "example": { "jwt": "", "proof_type": "" }, "properties": { "jwt": { "type": "string", "description": "Send the holder proof JWT (JSON Web Token). The captured value is redacted.", "example": "" }, "proof_type": { "type": "string", "description": "Send the proof type advertised by the issuer metadata.", "example": "" } }, "required": [ "jwt", "proof_type" ] } }, "required": [ "proof" ] }, "example": { "proof": { "jwt": "", "proof_type": "" } } } } } } }, "/v1/issuers/{slug}/.well-known/openid-credential-issuer": { "get": { "operationId": "v1_issuers_.well_known_openid_credential_issuer_retrieve", "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Send the issuer tenant slug.", "schema": { "type": "string" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit returned the OpenID4VCI issuer metadata.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential_configurations_supported": { "type": "object", "description": "You receive supported credential configurations keyed by VCT (Verifiable Credential Type). This captured issuer exposes five configurations.", "example": { "AgeOver18": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AgeOver18" }, "AirlineLoyalty": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AirlineLoyalty" }, "EmployeeBadge": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "EmployeeBadge" }, "MembershipCard": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "MembershipCard" }, "StudentID": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "StudentID" } }, "properties": { "AgeOver18": { "type": "object", "description": "Use this captured configuration to request an AgeOver18 credential.", "example": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AgeOver18" }, "properties": { "credential_signing_alg_values_supported": { "type": "array", "description": "You receive the credential signing algorithms this issuer supports.", "example": [ "ES256" ], "items": { "type": "string", "description": "A supported credential signing algorithm.", "example": "ES256" } }, "cryptographic_binding_methods_supported": { "type": "array", "description": "You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.", "example": [ "jwk" ], "items": { "type": "string", "description": "A supported holder binding method.", "example": "jwk" } }, "format": { "type": "string", "description": "Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.", "example": "dc+sd-jwt" }, "proof_types_supported": { "type": "object", "description": "You receive proof types the credential endpoint accepts.", "example": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "properties": { "jwt": { "type": "object", "description": "Use this JWT (JSON Web Token) proof type for holder proof-of-possession.", "example": { "proof_signing_alg_values_supported": [ "", "" ] }, "properties": { "proof_signing_alg_values_supported": { "type": "array", "description": "You receive the proof signing algorithms this issuer accepts.", "example": [ "", "" ], "items": { "type": "string", "description": "A supported proof signing algorithm.", "example": "" } } } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) for this configuration.", "example": "AgeOver18" } } }, "AirlineLoyalty": { "type": "object", "description": "Use this captured configuration to request an AirlineLoyalty credential.", "example": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AirlineLoyalty" }, "properties": { "credential_signing_alg_values_supported": { "type": "array", "description": "You receive the credential signing algorithms this issuer supports.", "example": [ "ES256" ], "items": { "type": "string", "description": "A supported credential signing algorithm.", "example": "ES256" } }, "cryptographic_binding_methods_supported": { "type": "array", "description": "You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.", "example": [ "jwk" ], "items": { "type": "string", "description": "A supported holder binding method.", "example": "jwk" } }, "format": { "type": "string", "description": "Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.", "example": "dc+sd-jwt" }, "proof_types_supported": { "type": "object", "description": "You receive proof types the credential endpoint accepts.", "example": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "properties": { "jwt": { "type": "object", "description": "Use this JWT (JSON Web Token) proof type for holder proof-of-possession.", "example": { "proof_signing_alg_values_supported": [ "", "" ] }, "properties": { "proof_signing_alg_values_supported": { "type": "array", "description": "You receive the proof signing algorithms this issuer accepts.", "example": [ "", "" ], "items": { "type": "string", "description": "A supported proof signing algorithm.", "example": "" } } } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) for this configuration.", "example": "AirlineLoyalty" } } }, "EmployeeBadge": { "type": "object", "description": "Use this captured configuration to request an EmployeeBadge credential.", "example": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "EmployeeBadge" }, "properties": { "credential_signing_alg_values_supported": { "type": "array", "description": "You receive the credential signing algorithms this issuer supports.", "example": [ "ES256" ], "items": { "type": "string", "description": "A supported credential signing algorithm.", "example": "ES256" } }, "cryptographic_binding_methods_supported": { "type": "array", "description": "You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.", "example": [ "jwk" ], "items": { "type": "string", "description": "A supported holder binding method.", "example": "jwk" } }, "format": { "type": "string", "description": "Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.", "example": "dc+sd-jwt" }, "proof_types_supported": { "type": "object", "description": "You receive proof types the credential endpoint accepts.", "example": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "properties": { "jwt": { "type": "object", "description": "Use this JWT (JSON Web Token) proof type for holder proof-of-possession.", "example": { "proof_signing_alg_values_supported": [ "", "" ] }, "properties": { "proof_signing_alg_values_supported": { "type": "array", "description": "You receive the proof signing algorithms this issuer accepts.", "example": [ "", "" ], "items": { "type": "string", "description": "A supported proof signing algorithm.", "example": "" } } } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) for this configuration.", "example": "EmployeeBadge" } } }, "MembershipCard": { "type": "object", "description": "Use this captured configuration to request a MembershipCard credential.", "example": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "MembershipCard" }, "properties": { "credential_signing_alg_values_supported": { "type": "array", "description": "You receive the credential signing algorithms this issuer supports.", "example": [ "ES256" ], "items": { "type": "string", "description": "A supported credential signing algorithm.", "example": "ES256" } }, "cryptographic_binding_methods_supported": { "type": "array", "description": "You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.", "example": [ "jwk" ], "items": { "type": "string", "description": "A supported holder binding method.", "example": "jwk" } }, "format": { "type": "string", "description": "Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.", "example": "dc+sd-jwt" }, "proof_types_supported": { "type": "object", "description": "You receive proof types the credential endpoint accepts.", "example": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "properties": { "jwt": { "type": "object", "description": "Use this JWT (JSON Web Token) proof type for holder proof-of-possession.", "example": { "proof_signing_alg_values_supported": [ "", "" ] }, "properties": { "proof_signing_alg_values_supported": { "type": "array", "description": "You receive the proof signing algorithms this issuer accepts.", "example": [ "", "" ], "items": { "type": "string", "description": "A supported proof signing algorithm.", "example": "" } } } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) for this configuration.", "example": "MembershipCard" } } }, "StudentID": { "type": "object", "description": "Use this captured configuration to request a StudentID credential.", "example": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "StudentID" }, "properties": { "credential_signing_alg_values_supported": { "type": "array", "description": "You receive the credential signing algorithms this issuer supports.", "example": [ "ES256" ], "items": { "type": "string", "description": "A supported credential signing algorithm.", "example": "ES256" } }, "cryptographic_binding_methods_supported": { "type": "array", "description": "You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.", "example": [ "jwk" ], "items": { "type": "string", "description": "A supported holder binding method.", "example": "jwk" } }, "format": { "type": "string", "description": "Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.", "example": "dc+sd-jwt" }, "proof_types_supported": { "type": "object", "description": "You receive proof types the credential endpoint accepts.", "example": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "properties": { "jwt": { "type": "object", "description": "Use this JWT (JSON Web Token) proof type for holder proof-of-possession.", "example": { "proof_signing_alg_values_supported": [ "", "" ] }, "properties": { "proof_signing_alg_values_supported": { "type": "array", "description": "You receive the proof signing algorithms this issuer accepts.", "example": [ "", "" ], "items": { "type": "string", "description": "A supported proof signing algorithm.", "example": "" } } } } } }, "vct": { "type": "string", "description": "You receive the VCT (Verifiable Credential Type) for this configuration.", "example": "StudentID" } } } } }, "credential_endpoint": { "type": "string", "description": "Call this endpoint to redeem a holder proof for the issued credential.", "example": "http://localhost:8011/v1/credential", "format": "uri" }, "credential_issuer": { "type": "string", "description": "Use this issuer identifier as the audience for holder proofs.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "jwt_vc_issuer": { "type": "string", "description": "Fetch this URL to get the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuer metadata and JWKS (JSON Web Key Set).", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6/.well-known/jwt-vc-issuer", "format": "uri" }, "nonce_endpoint": { "type": "string", "description": "Call this endpoint to mint the nonce for the holder proof.", "example": "http://localhost:8011/v1/nonce", "format": "uri" }, "token_endpoint": { "type": "string", "description": "Call this endpoint to exchange the pre-authorized code for an issuance access token.", "example": "http://localhost:8011/v1/oauth/token", "format": "uri" } } }, "example": { "credential_configurations_supported": { "AgeOver18": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AgeOver18" }, "AirlineLoyalty": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "AirlineLoyalty" }, "EmployeeBadge": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "EmployeeBadge" }, "MembershipCard": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "MembershipCard" }, "StudentID": { "credential_signing_alg_values_supported": [ "ES256" ], "cryptographic_binding_methods_supported": [ "jwk" ], "format": "dc+sd-jwt", "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": [ "", "" ] } }, "vct": "StudentID" } }, "credential_endpoint": "http://localhost:8011/v1/credential", "credential_issuer": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "jwt_vc_issuer": "http://localhost:8011/v1/issuers/docs-capture-z2373a/.well-known/jwt-vc-issuer", "nonce_endpoint": "http://localhost:8011/v1/nonce", "token_endpoint": "http://localhost:8011/v1/oauth/token" } } } }, "404": { "description": "No tenant exists for the given slug (or it is soft-deleted).", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Human-readable not-found message.", "example": "Not found." } } } } } } }, "summary": "OpenID4VCI issuer metadata", "description": "Fetch the OpenID4VCI (OpenID for Verifiable Credential Issuance) issuer metadata for a tenant. Wallets use this document to discover the credential, nonce, token, and SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuer endpoints. The metadata also lists credential configurations keyed by VCT (Verifiable Credential Type).", "security": [] } }, "/v1/issuers/{slug}/.well-known/jwt-vc-issuer": { "get": { "operationId": "v1_issuers_.well_known_jwt_vc_issuer_retrieve", "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Send the issuer tenant slug.", "schema": { "type": "string" } } ], "tags": [ "OpenID4VCI Protocol" ], "responses": { "200": { "description": "Didit returned the issuer identifier and signing keys.", "content": { "application/json": { "schema": { "type": "object", "properties": { "issuer": { "type": "string", "description": "Use this issuer identifier to match credentials from this tenant.", "example": "http://localhost:8011/v1/issuers/docs-capture-6clew6", "format": "uri" }, "jwks": { "type": "object", "description": "Use this JWKS (JSON Web Key Set) to validate credentials signed by the issuer.", "example": { "keys": [ { "crv": "P-256", "kid": "9hStvT31-vXqUluU380kWkrTdInbdUf_4jh1-vooYks", "kty": "EC", "x": "W1zJcTfyyQW5XfreBp-CMPnQY8-vc2ilG-tIy7IUamY", "y": "tyQkIJP5gyUtaoHjPQxbor92GpC9ee2IA8z1dmMYLRI" } ] }, "properties": { "keys": { "type": "array", "description": "You receive issuer public JWKs (JSON Web Keys).", "example": [ { "crv": "P-256", "kid": "9hStvT31-vXqUluU380kWkrTdInbdUf_4jh1-vooYks", "kty": "EC", "x": "W1zJcTfyyQW5XfreBp-CMPnQY8-vc2ilG-tIy7IUamY", "y": "tyQkIJP5gyUtaoHjPQxbor92GpC9ee2IA8z1dmMYLRI" } ], "items": { "type": "object", "properties": { "crv": { "type": "string", "description": "You receive the elliptic curve name for the issuer key.", "example": "P-256" }, "kid": { "type": "string", "description": "Use this key identifier to select the matching issuer key.", "example": "9hStvT31-vXqUluU380kWkrTdInbdUf_4jh1-vooYks" }, "kty": { "type": "string", "description": "You receive the JWK (JSON Web Key) key type.", "example": "EC" }, "x": { "type": "string", "description": "You receive the x-coordinate of the issuer public key.", "example": "W1zJcTfyyQW5XfreBp-CMPnQY8-vc2ilG-tIy7IUamY" }, "y": { "type": "string", "description": "You receive the y-coordinate of the issuer public key.", "example": "tyQkIJP5gyUtaoHjPQxbor92GpC9ee2IA8z1dmMYLRI" } } } } } } } }, "example": { "issuer": "http://localhost:8011/v1/issuers/docs-capture-z2373a", "jwks": { "keys": [ { "crv": "P-256", "kid": "DgJ8yLHSJHxiSzbaJvRRUZfHYoyGxOEfhj4pCdslUCY", "kty": "EC", "x": "_Cs0Wmu3BnuCY171v4dkGKdL30jAPGkF1yKBJw9VsIc", "y": "HizpM7bgczntfxtwarx1l1ZQgpD6yQE7TbRae1d4l1c" } ] } } } } }, "404": { "description": "No tenant exists for the given slug (or it is soft-deleted).", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "Human-readable not-found message.", "example": "Not found." } } } } } } }, "summary": "SD-JWT VC issuer JWKS", "description": "Fetch the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuer metadata for a tenant. Wallets and verifiers use the returned JWKS (JSON Web Key Set) to validate credentials signed by this issuer.", "security": [] } }, "/v1/trust-frameworks/{slug}": { "delete": { "tags": [ "Trust Registry" ], "operationId": "deleteTrustFrameworksSlug", "summary": "Delete a custom framework (204; governed -> 403).", "description": "Delete a custom trust framework. You cannot delete governed frameworks because their governance authority manages them. A successful deletion returns no response body.", "security": [ { "bearerAuth": [] } ], "responses": { "204": { "description": "The custom trust framework was deleted. No response body is returned." }, "403": { "description": "Forbidden \u2014 the caller lacks the required privilege, or the resource is immutable. (Example: deleting a governed framework.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "You receive the reason the governed framework cannot be deleted.", "example": "'ISO/IEC 18013-5 mDL' is a governed framework managed by its governance authority \u2014 it cannot be edited or deleted. Create a custom framework instead." } } }, "example": { "detail": "'ISO/IEC 18013-5 mDL' is a governed framework managed by its governance authority \u2014 it cannot be edited or deleted. Create a custom framework instead." } } } } }, "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the custom trust framework to delete.", "schema": { "type": "string" } } ] }, "get": { "tags": [ "Trust Registry" ], "operationId": "getTrustFrameworksSlug", "summary": "Fetch one trust framework by slug.", "description": "Fetch one trust framework by slug. You use this endpoint to inspect a custom or governed framework before linking it to a trusted issuer.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "The trust framework matching the requested slug.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the stable UUID for this trust framework.", "example": "5225b027-6ce6-482e-8b99-5362dffb5a7e", "format": "uuid" }, "slug": { "type": "string", "description": "You receive the URL-safe identifier for this framework.", "example": "acme-partner-framework-ypr5" }, "name": { "type": "string", "description": "You receive the display name for the framework.", "example": "ACME Partner Framework ypr5" }, "region": { "type": "string", "description": "You receive the region or jurisdiction for the framework.", "example": "EU" }, "profile": { "type": "string", "description": "You receive the interoperability profile for the framework.", "example": "custom" }, "formats": { "type": "array", "description": "You receive credential format identifiers such as `sd_jwt_vc` for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential).", "example": [ "sd_jwt_vc" ], "items": { "type": "string", "description": "You receive one credential format identifier.", "example": "sd_jwt_vc" } }, "description": { "type": "string", "description": "You receive the framework summary shown to API consumers.", "example": "Partner onboarding trust rules." }, "custom": { "type": "boolean", "description": "You receive `true` when the framework is tenant-owned.", "example": true }, "editable": { "type": "boolean", "description": "You receive `true` when you can update or delete the framework.", "example": true }, "governed": { "type": "boolean", "description": "You receive `true` when a governance authority manages the framework.", "example": false }, "trusted": { "type": "boolean", "description": "You receive `true` when this framework is currently trusted for the tenant. Governed frameworks are trusted by default.", "example": true }, "member_issuer_count": { "type": "integer", "description": "You receive the number of trusted issuers registered under this framework for the tenant.", "example": 3 }, "member_issuers": { "type": "array", "description": "You receive up to `member_issuer_limit` issuers registered under this framework, each annotated with whether an override blocks it.", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID of the member issuer.", "example": "ef799a56-23dc-467d-9760-9fd20a8457fa", "format": "uuid" }, "name": { "type": "string", "description": "You receive the member issuer display name.", "example": "Gov PID Issuer" }, "iss": { "type": "string", "description": "You receive the member issuer identifier.", "example": "https://issuer.gov.example", "format": "uri" }, "blocked": { "type": "boolean", "description": "You receive `true` when this issuer is blocked within the framework by an issuer override.", "example": false } } } }, "member_issuer_limit": { "type": "integer", "description": "You receive the maximum number of issuers returned in `member_issuers`.", "example": 100 }, "member_issuers_truncated": { "type": "boolean", "description": "You receive `true` when `member_issuer_count` exceeds `member_issuer_limit`, meaning `member_issuers` is truncated.", "example": false } } }, "example": { "custom": true, "description": "Partner onboarding trust rules.", "editable": true, "formats": [ "sd_jwt_vc" ], "governed": false, "id": "ef84dbdc-c2d3-4b8d-91f7-3c94089ed228", "name": "ACME Partner Framework y4bf", "profile": "custom", "region": "EU", "slug": "acme-partner-framework-y4bf" } } } } }, "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the trust framework to fetch.", "schema": { "type": "string" } } ] }, "patch": { "tags": [ "Trust Registry" ], "operationId": "patchTrustFrameworksSlug", "summary": "Edit a custom framework (governed frameworks are immutable -> 403).", "description": "Edit a custom trust framework. You cannot edit governed frameworks because their governance authority manages them.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "The custom trust framework was updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the stable UUID for this trust framework.", "example": "5225b027-6ce6-482e-8b99-5362dffb5a7e", "format": "uuid" }, "slug": { "type": "string", "description": "You receive the URL-safe identifier for this framework.", "example": "acme-partner-framework-ypr5" }, "name": { "type": "string", "description": "You receive the display name for the framework.", "example": "ACME Partner Framework ypr5" }, "region": { "type": "string", "description": "You receive the region or jurisdiction for the framework.", "example": "EU" }, "profile": { "type": "string", "description": "You receive the interoperability profile for the framework.", "example": "custom" }, "formats": { "type": "array", "description": "You receive credential format identifiers such as `sd_jwt_vc` for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential).", "example": [ "sd_jwt_vc" ], "items": { "type": "string", "description": "You receive one credential format identifier.", "example": "sd_jwt_vc" } }, "description": { "type": "string", "description": "You receive the framework summary shown to API consumers.", "example": "Updated partner onboarding trust rules." }, "custom": { "type": "boolean", "description": "You receive `true` when the framework is tenant-owned.", "example": true }, "editable": { "type": "boolean", "description": "You receive `true` when you can update or delete the framework.", "example": true }, "governed": { "type": "boolean", "description": "You receive `true` when a governance authority manages the framework.", "example": false } } }, "example": { "custom": true, "description": "Updated partner onboarding trust rules.", "editable": true, "formats": [ "sd_jwt_vc" ], "governed": false, "id": "ef84dbdc-c2d3-4b8d-91f7-3c94089ed228", "name": "ACME Partner Framework y4bf", "profile": "custom", "region": "EU", "slug": "acme-partner-framework-y4bf" } } } }, "403": { "description": "Forbidden \u2014 the caller lacks the required privilege, or the resource is immutable. (Example: editing a governed framework.)", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "You receive the reason the governed framework cannot be changed.", "example": "'eIDAS 2.0 (EUDI)' is a governed framework managed by its governance authority \u2014 it cannot be edited or deleted. Create a custom framework instead." } } }, "example": { "detail": "'eIDAS 2.0 (EUDI)' is a governed framework managed by its governance authority \u2014 it cannot be edited or deleted. Create a custom framework instead." } } } } }, "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the custom trust framework to update.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string", "description": "You set the updated framework summary.", "example": "Updated partner onboarding trust rules." } }, "required": [ "description" ] }, "example": { "description": "Updated partner onboarding trust rules." } } } } } }, "/v1/credential-schemas/{uuid}": { "get": { "tags": [ "Credentials" ], "operationId": "getCredentialSchemasUuid", "summary": "Fetch one schema plus its full version family.", "description": "Fetch one credential schema and its version family. Use this to inspect the current schema fields and see which versions are active or deprecated.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Credential schema details with its version history.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the credential schema.", "example": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable schema name.", "example": "Loyalty Membership" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value embedded in credentials issued from this schema.", "example": "AirlineLoyalty" }, "version": { "type": "string", "description": "Schema version string.", "example": "1.0" }, "format": { "type": "string", "description": "Credential format. The captured value is `sd_jwt_vc`, the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format.", "example": "sd_jwt_vc" }, "attributes": { "type": "array", "description": "Claim attributes that make up the credential.", "example": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name as it appears in the credential.", "example": "given_name" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } } } }, "branding": { "type": "object", "description": "Wallet branding object returned with the schema. The captured example is an empty object.", "example": {}, "properties": {} }, "revocable": { "type": "boolean", "description": "Whether issued credentials from this schema can be revoked.", "example": true }, "status": { "type": "string", "description": "Lifecycle status of this schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": null, "format": "uuid" }, "created_at": { "type": "string", "description": "Timestamp when the schema was created.", "example": "2026-07-02T23:33:33.468912Z", "format": "date-time" }, "versions": { "type": "array", "description": "Version family for this schema.", "example": [ { "created_at": "2026-07-02T23:33:33.468912+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": null, "uuid": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "vct": "AirlineLoyalty", "version": "1.0" } ], "items": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of this schema version.", "example": "2e844e4b-e7da-4d94-828e-eee9bdf66349", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value for this schema version.", "example": "AirlineLoyalty" }, "version": { "type": "string", "description": "Version string for this schema version.", "example": "1.0" }, "status": { "type": "string", "description": "Lifecycle status of this schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": null, "format": "uuid" }, "is_latest": { "type": "boolean", "description": "Whether this is the latest version in the family.", "example": true }, "issued_count": { "type": "integer", "description": "Number of credentials issued from this schema version.", "example": 0 }, "created_at": { "type": "string", "description": "Timestamp when this schema version was created.", "example": "2026-07-02T23:33:33.468912+00:00", "format": "date-time" } } } } } }, "example": { "attributes": [ { "name": "given_name", "sd": true }, { "name": "tier", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:57.328099Z", "format": "sd_jwt_vc", "name": "Loyalty Membership", "revocable": true, "status": "active", "supersedes": null, "uuid": "5e41f295-5b7b-456a-989d-582373595319", "vct": "AirlineLoyalty", "version": "1.0", "versions": [ { "created_at": "2026-07-02T23:51:57.328099+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": null, "uuid": "5e41f295-5b7b-456a-989d-582373595319", "vct": "AirlineLoyalty", "version": "1.0" } ] } } } } }, "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the credential schema to fetch.", "schema": { "type": "string" } } ] }, "patch": { "tags": [ "Credentials" ], "operationId": "patchCredentialSchemasUuid", "summary": "Deprecate or reactivate a schema version (deprecated blocks NEW issuance only).", "description": "Update the status of a schema version. Use this to change whether that version can be used for new issuance. The response includes the schema and its version family.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "The schema version status was updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the credential schema version.", "example": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable schema name.", "example": "Employee Badge kgm1" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value embedded in credentials issued from this schema.", "example": "EmployeeBadge" }, "version": { "type": "string", "description": "Schema version string.", "example": "1.0" }, "format": { "type": "string", "description": "Credential format. The captured value is `sd_jwt_vc`, the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format.", "example": "sd_jwt_vc" }, "attributes": { "type": "array", "description": "Claim attributes stored on this schema version.", "example": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name as it appears in the credential.", "example": "employee_id" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } } } }, "branding": { "type": "object", "description": "Wallet branding object returned with the schema. The captured example is an empty object.", "example": {}, "properties": {} }, "revocable": { "type": "boolean", "description": "Whether issued credentials from this schema can be revoked.", "example": true }, "status": { "type": "string", "description": "Lifecycle status of this schema version after the update.", "example": "deprecated" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": null, "format": "uuid" }, "created_at": { "type": "string", "description": "Timestamp when the schema version was created.", "example": "2026-07-02T23:33:33.625738Z", "format": "date-time" }, "versions": { "type": "array", "description": "Version family for this schema.", "example": [ { "created_at": "2026-07-02T23:33:33.637740+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "uuid": "315145dd-d88e-41ae-997f-d35e2e81edd0", "vct": "EmployeeBadge", "version": "1.1" }, { "created_at": "2026-07-02T23:33:33.625738+00:00", "is_latest": false, "issued_count": 1, "status": "deprecated", "supersedes": null, "uuid": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "vct": "EmployeeBadge", "version": "1.0" } ], "items": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of this schema version.", "example": "315145dd-d88e-41ae-997f-d35e2e81edd0", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value for this schema version.", "example": "EmployeeBadge" }, "version": { "type": "string", "description": "Version string for this schema version.", "example": "1.1" }, "status": { "type": "string", "description": "Lifecycle status of this schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "format": "uuid" }, "is_latest": { "type": "boolean", "description": "Whether this is the latest version in the family.", "example": true }, "issued_count": { "type": "integer", "description": "Number of credentials issued from this schema version.", "example": 0 }, "created_at": { "type": "string", "description": "Timestamp when this schema version was created.", "example": "2026-07-02T23:33:33.637740+00:00", "format": "date-time" } } } } } }, "example": { "attributes": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false } ], "branding": {}, "created_at": "2026-07-02T23:51:57.488704Z", "format": "sd_jwt_vc", "name": "Employee Badge 2uq3", "revocable": true, "status": "deprecated", "supersedes": null, "uuid": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "vct": "EmployeeBadge", "version": "1.0", "versions": [ { "created_at": "2026-07-02T23:51:57.499691+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "uuid": "e7b1f75a-c253-4460-84cf-594939db452d", "vct": "EmployeeBadge", "version": "1.1" }, { "created_at": "2026-07-02T23:51:57.488704+00:00", "is_latest": false, "issued_count": 1, "status": "deprecated", "supersedes": null, "uuid": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "vct": "EmployeeBadge", "version": "1.0" } ] } } } } }, "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the credential schema version to update.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "string", "description": "New lifecycle status for the schema version.", "example": "deprecated" } }, "required": [ "status" ] }, "example": { "status": "deprecated" } } } } } }, "/v1/credential-schemas/{uuid}/revoke-credentials": { "post": { "tags": [ "Credentials" ], "operationId": "postCredentialSchemasUuidRevokeCredentials", "summary": "Bulk-revoke every live credential issued under this schema version (destructive).", "description": "Bulk revoke live credentials issued under one schema version. Use this carefully because it is destructive for affected credentials. The response tells you how many credentials were revoked.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "The credentials issued under this schema version were revoked.", "content": { "application/json": { "schema": { "type": "object", "properties": { "revoked": { "type": "integer", "description": "Number of credentials revoked by the bulk operation.", "example": 1 }, "schema_id": { "type": "string", "description": "UUID of the schema version used for the bulk revoke.", "example": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "format": "uuid" }, "version": { "type": "string", "description": "Version string of the schema version used for the bulk revoke.", "example": "1.0" } } }, "example": { "revoked": 1, "schema_id": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "version": "1.0" } } } } }, "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the credential schema version whose credentials you want to revoke.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "example": {} } } } } }, "/v1/credential-schemas/{uuid}/versions": { "post": { "tags": [ "Credentials" ], "operationId": "postCredentialSchemasUuidVersions", "summary": "Cut the next immutable version of a schema (bumps version, deprecates the source).", "description": "Create the next immutable version of a credential schema. You provide the attributes for the new version. The response returns the new version and the full version family.", "security": [ { "bearerAuth": [] } ], "responses": { "201": { "description": "The next schema version was created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of the new credential schema version.", "example": "315145dd-d88e-41ae-997f-d35e2e81edd0", "format": "uuid" }, "name": { "type": "string", "description": "Human-readable schema name.", "example": "Employee Badge kgm1" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value embedded in credentials issued from this schema.", "example": "EmployeeBadge" }, "version": { "type": "string", "description": "Schema version string for the new version.", "example": "1.1" }, "format": { "type": "string", "description": "Credential format. The captured value is `sd_jwt_vc`, the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) format.", "example": "sd_jwt_vc" }, "attributes": { "type": "array", "description": "Claim attributes stored on the new schema version.", "example": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false }, { "name": "clearance", "sd": true } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name as it appears in the credential.", "example": "employee_id" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } } } }, "branding": { "type": "object", "description": "Wallet branding object returned with the schema. The captured example is an empty object.", "example": {}, "properties": {} }, "revocable": { "type": "boolean", "description": "Whether issued credentials from this schema can be revoked.", "example": true }, "status": { "type": "string", "description": "Lifecycle status of the new schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes.", "example": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "format": "uuid" }, "created_at": { "type": "string", "description": "Timestamp when the new schema version was created.", "example": "2026-07-02T23:33:33.637740Z", "format": "date-time" }, "versions": { "type": "array", "description": "Version family for this schema.", "example": [ { "created_at": "2026-07-02T23:33:33.637740+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "uuid": "315145dd-d88e-41ae-997f-d35e2e81edd0", "vct": "EmployeeBadge", "version": "1.1" }, { "created_at": "2026-07-02T23:33:33.625738+00:00", "is_latest": false, "issued_count": 1, "status": "deprecated", "supersedes": null, "uuid": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "vct": "EmployeeBadge", "version": "1.0" } ], "items": { "type": "object", "properties": { "uuid": { "type": "string", "description": "Unique identifier of this schema version.", "example": "315145dd-d88e-41ae-997f-d35e2e81edd0", "format": "uuid" }, "vct": { "type": "string", "description": "VCT (Verifiable Credential Type) value for this schema version.", "example": "EmployeeBadge" }, "version": { "type": "string", "description": "Version string for this schema version.", "example": "1.1" }, "status": { "type": "string", "description": "Lifecycle status of this schema version.", "example": "active" }, "supersedes": { "type": [ "string", "null" ], "description": "Schema UUID that this version supersedes. Null means this is the first version.", "example": "c24a6fbe-3375-42d0-aead-c5f628f6a18d", "format": "uuid" }, "is_latest": { "type": "boolean", "description": "Whether this is the latest version in the family.", "example": true }, "issued_count": { "type": "integer", "description": "Number of credentials issued from this schema version.", "example": 0 }, "created_at": { "type": "string", "description": "Timestamp when this schema version was created.", "example": "2026-07-02T23:33:33.637740+00:00", "format": "date-time" } } } } } }, "example": { "attributes": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false }, { "name": "clearance", "sd": true } ], "branding": {}, "created_at": "2026-07-02T23:51:57.499691Z", "format": "sd_jwt_vc", "name": "Employee Badge 2uq3", "revocable": true, "status": "active", "supersedes": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "uuid": "e7b1f75a-c253-4460-84cf-594939db452d", "vct": "EmployeeBadge", "version": "1.1", "versions": [ { "created_at": "2026-07-02T23:51:57.499691+00:00", "is_latest": true, "issued_count": 0, "status": "active", "supersedes": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "uuid": "e7b1f75a-c253-4460-84cf-594939db452d", "vct": "EmployeeBadge", "version": "1.1" }, { "created_at": "2026-07-02T23:51:57.488704+00:00", "is_latest": false, "issued_count": 1, "status": "deprecated", "supersedes": null, "uuid": "17be73de-c44f-4f7d-ab62-b37199cc5e2f", "vct": "EmployeeBadge", "version": "1.0" } ] } } } } }, "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the source credential schema version.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "attributes": { "type": "array", "description": "Claim attributes for the new schema version.", "example": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false }, { "name": "clearance", "sd": true } ], "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Claim name to include in the new schema version.", "example": "employee_id" }, "sd": { "type": "boolean", "description": "Whether the claim supports selective disclosure.", "example": true } }, "required": [ "name", "sd" ] } } }, "required": [ "attributes" ] }, "example": { "attributes": [ { "name": "employee_id", "sd": true }, { "name": "department", "sd": false }, { "name": "clearance", "sd": true } ] } } } } } }, "/v1/trust-frameworks/{slug}/trust": { "get": { "operationId": "getTrustFrameworksSlugTrust", "tags": [ "Trust Registry" ], "summary": "Get framework trust state", "description": "Return whether a trust framework is currently trusted for the tenant, and whether that value is the framework default or an explicit override. Pass an optional `relying_party` query parameter to read the per-relying-party trust state.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the trust framework.", "schema": { "type": "string" } }, { "name": "relying_party", "in": "query", "required": false, "description": "Optional relying party UUID to scope the trust state to.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "The framework trust state for the tenant.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string", "description": "You receive the framework slug.", "example": "eidas2" }, "enabled": { "type": "boolean", "description": "You receive `true` when the framework is trusted.", "example": true }, "is_default": { "type": "boolean", "description": "You receive `true` when `enabled` is the framework default (no explicit override exists).", "example": true } } }, "example": { "slug": "eidas2", "enabled": true, "is_default": true } } } } } }, "put": { "operationId": "putTrustFrameworksSlugTrust", "tags": [ "Trust Registry" ], "summary": "Trust or untrust a framework", "description": "Trust or untrust an entire framework for the tenant in one call. Every issuer that belongs to a trusted framework passes the verification trust gate without being registered individually. Pass an optional `relying_party` to scope the setting to one relying party.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the trust framework.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "You set whether the framework is trusted.", "example": true }, "relying_party": { "type": "string", "description": "You optionally scope the setting to a relying party by UUID.", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "format": "uuid" } }, "required": [ "enabled" ] }, "example": { "enabled": true } } } }, "responses": { "200": { "description": "The framework trust setting was applied.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string", "description": "You receive the framework slug.", "example": "eidas2" }, "enabled": { "type": "boolean", "description": "You receive the stored trust value.", "example": true }, "effective": { "type": "boolean", "description": "You receive the effective trust decision after applying overrides.", "example": true } } }, "example": { "slug": "eidas2", "enabled": true, "effective": true } } } } } } }, "/v1/trust-frameworks/{slug}/issuer-overrides": { "post": { "operationId": "postTrustFrameworksSlugIssuerOverrides", "tags": [ "Trust Registry" ], "summary": "Block or unblock an issuer in a framework", "description": "Block or unblock a single issuer within a trusted framework. Blocking removes just that issuer from the framework's blanket trust while leaving every other member issuer trusted. Send `blocked: false` to lift a previously set block. Pass an optional `relying_party` to scope the override to one relying party.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Slug of the trust framework.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "iss": { "type": "string", "description": "You set the issuer identifier to block or unblock.", "example": "https://issuer.gov.example", "format": "uri" }, "blocked": { "type": "boolean", "description": "You set `true` to block the issuer, `false` to unblock it.", "example": true }, "relying_party": { "type": "string", "description": "You optionally scope the override to a relying party by UUID.", "example": "44b2d61a-1634-486b-a35a-df26eb653a1a", "format": "uuid" } }, "required": [ "iss", "blocked" ] }, "example": { "iss": "https://issuer.gov.example", "blocked": true } } } }, "responses": { "200": { "description": "The issuer override was applied.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string", "description": "You receive the framework slug.", "example": "eidas2" }, "iss": { "type": "string", "description": "You receive the normalized issuer identifier.", "example": "https://issuer.gov.example", "format": "uri" }, "blocked": { "type": "boolean", "description": "You receive the effective blocked state for this issuer in the framework.", "example": true } } }, "example": { "slug": "eidas2", "iss": "https://issuer.gov.example", "blocked": true } } } } } } }, "/v1/webhooks": { "get": { "operationId": "getWebhooks", "tags": [ "Webhooks" ], "summary": "List webhook endpoints", "description": "List the webhook endpoints registered under the tenant. Signing secrets are masked in this response \u2014 the full secret is only returned when you create an endpoint or rotate its secret. The response is a bare JSON array ordered by most recent creation time.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "A bare JSON array of webhook endpoint objects.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this webhook endpoint.", "example": "b8f0f4a2-2b1e-4b3a-9d0e-4a1c2d3e4f50", "format": "uuid" }, "label": { "type": "string", "description": "You receive the endpoint label.", "example": "Production events" }, "url": { "type": "string", "description": "You receive the destination URL that receives POST deliveries.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "secret": { "type": "string", "description": "You receive the masked signing secret (only the last 4 characters are shown).", "example": "********s9Zx" }, "subscribed_events": { "type": "array", "description": "You receive the event types this endpoint is subscribed to. An empty array means all event types are delivered.", "items": { "type": "string", "description": "You receive one subscribed event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "credential.issued", "presentation.verified" ] }, "enabled": { "type": "boolean", "description": "You receive `true` when the endpoint is active and receiving deliveries.", "example": true }, "created_at": { "type": "string", "description": "You receive the timestamp when the endpoint was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "updated_at": { "type": "string", "description": "You receive the timestamp when the endpoint was last updated.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } } } } } } } }, "post": { "operationId": "postWebhooks", "tags": [ "Webhooks" ], "summary": "Create a webhook endpoint", "description": "Register a webhook endpoint. Didit ID signs every delivery with the returned secret using HMAC-SHA256 and sends the `X-Didit-Signature` and `X-Didit-Timestamp` headers (see the signature-verification note below). Save the returned `secret` \u2014 it is only shown once. Provide `subscribed_events` to filter, or omit it to receive every event type.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "label": { "type": "string", "description": "You set a human-readable label for the endpoint.", "example": "Production events" }, "url": { "type": "string", "description": "You set the destination URL (http or https) that receives POST deliveries.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "subscribed_events": { "type": "array", "description": "You optionally set the event types to deliver. Omit or send an empty array to receive every event type.", "items": { "type": "string", "description": "One subscribed event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "credential.issued", "presentation.verified" ] }, "enabled": { "type": "boolean", "description": "You optionally set whether the endpoint is active. Defaults to `true`.", "example": true } }, "required": [ "label", "url" ] }, "example": { "label": "Production events", "url": "https://api.acme.example/webhooks/didit", "subscribed_events": [ "credential.issued", "presentation.verified" ] } } } }, "responses": { "201": { "description": "The webhook endpoint was created. The full signing secret is returned once.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this webhook endpoint.", "example": "b8f0f4a2-2b1e-4b3a-9d0e-4a1c2d3e4f50", "format": "uuid" }, "label": { "type": "string", "description": "You receive the endpoint label.", "example": "Production events" }, "url": { "type": "string", "description": "You receive the destination URL that receives POST deliveries.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "secret": { "type": "string", "description": "You receive the full signing secret. Store it now \u2014 subsequent reads mask it.", "example": "kQ8v...s9Zx" }, "subscribed_events": { "type": "array", "description": "You receive the event types this endpoint is subscribed to. An empty array means all event types are delivered.", "items": { "type": "string", "description": "You receive one subscribed event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "credential.issued", "presentation.verified" ] }, "enabled": { "type": "boolean", "description": "You receive `true` when the endpoint is active and receiving deliveries.", "example": true }, "created_at": { "type": "string", "description": "You receive the timestamp when the endpoint was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "updated_at": { "type": "string", "description": "You receive the timestamp when the endpoint was last updated.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } } } } } } } }, "/v1/webhooks/deliveries": { "get": { "operationId": "getWebhookDeliveries", "tags": [ "Webhooks" ], "summary": "List webhook deliveries", "description": "List the most recent webhook delivery attempts (up to 100) for the tenant, newest first. Pass the optional `endpoint` query parameter to filter to a single endpoint.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "endpoint", "in": "query", "required": false, "description": "Optional webhook endpoint UUID to filter deliveries by.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "A bare JSON array of webhook delivery objects.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this delivery attempt.", "example": "c9a1b2c3-d4e5-6f70-8192-a3b4c5d6e7f8", "format": "uuid" }, "endpoint_id": { "type": "string", "description": "You receive the UUID of the endpoint this delivery targeted.", "example": "b8f0f4a2-2b1e-4b3a-9d0e-4a1c2d3e4f50", "format": "uuid" }, "endpoint_label": { "type": "string", "description": "You receive the label of the endpoint this delivery targeted.", "example": "Production events" }, "event_type": { "type": "string", "description": "You receive the event type that was delivered.", "example": "credential.issued" }, "event_id": { "type": "string", "description": "You receive the unique event identifier carried in the payload.", "example": "evt_9f3c1a20b7" }, "request_url": { "type": "string", "description": "You receive the URL the delivery was POSTed to.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "response_status": { "type": [ "integer", "null" ], "description": "You receive the HTTP status code returned by the endpoint, or null when the request never completed.", "example": 200 }, "response_time_ms": { "type": [ "integer", "null" ], "description": "You receive the round-trip time in milliseconds, or null when the request never completed.", "example": 142 }, "status": { "type": "string", "description": "You receive the delivery status (for example `delivered`, `failed`, or `pending`).", "example": "delivered" }, "retries": { "type": "integer", "description": "You receive the number of retry attempts made for this delivery.", "example": 0 }, "last_retry_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent retry, or null when there was none.", "example": null, "format": "date-time" }, "created_at": { "type": "string", "description": "You receive the timestamp when the delivery was enqueued.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } } } } } } } } }, "/v1/webhooks/{uuid}": { "patch": { "operationId": "patchWebhooksUuid", "tags": [ "Webhooks" ], "summary": "Update a webhook endpoint", "description": "Update a webhook endpoint's `label`, `url`, `subscribed_events`, or `enabled` flag. Send `rotate_secret: true` to generate a new signing secret \u2014 the new secret is returned in full in that response only. Send only the fields you want to change.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the webhook endpoint to update.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "label": { "type": "string", "description": "You optionally set the endpoint label.", "example": "Production events" }, "url": { "type": "string", "description": "You optionally set the destination URL.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "subscribed_events": { "type": "array", "description": "You optionally replace the subscribed event types.", "items": { "type": "string", "description": "One subscribed event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "credential.revoked" ] }, "enabled": { "type": "boolean", "description": "You optionally enable or disable the endpoint.", "example": true }, "rotate_secret": { "type": "boolean", "description": "You optionally rotate the signing secret. When `true`, the response returns the new secret in full.", "example": false } } }, "example": { "enabled": false } } } }, "responses": { "200": { "description": "The webhook endpoint was updated. The `secret` is returned in full only when `rotate_secret` was `true`, otherwise it is masked.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this webhook endpoint.", "example": "b8f0f4a2-2b1e-4b3a-9d0e-4a1c2d3e4f50", "format": "uuid" }, "label": { "type": "string", "description": "You receive the endpoint label.", "example": "Production events" }, "url": { "type": "string", "description": "You receive the destination URL that receives POST deliveries.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "secret": { "type": "string", "description": "You receive the masked signing secret (only the last 4 characters are shown).", "example": "********s9Zx" }, "subscribed_events": { "type": "array", "description": "You receive the event types this endpoint is subscribed to. An empty array means all event types are delivered.", "items": { "type": "string", "description": "You receive one subscribed event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "credential.issued", "presentation.verified" ] }, "enabled": { "type": "boolean", "description": "You receive `true` when the endpoint is active and receiving deliveries.", "example": true }, "created_at": { "type": "string", "description": "You receive the timestamp when the endpoint was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "updated_at": { "type": "string", "description": "You receive the timestamp when the endpoint was last updated.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } } } } } } }, "delete": { "operationId": "deleteWebhooksUuid", "tags": [ "Webhooks" ], "summary": "Delete a webhook endpoint", "description": "Delete a webhook endpoint. Didit ID stops delivering events to it immediately. A successful deletion returns no response body.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the webhook endpoint to delete.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "The webhook endpoint was deleted. No response body is returned." } } } }, "/v1/webhooks/{uuid}/test": { "post": { "operationId": "postWebhooksUuidTest", "tags": [ "Webhooks" ], "summary": "Send a test event", "description": "Enqueue a signed `webhook.test` event to the endpoint so you can confirm your receiver verifies the signature and returns 2xx. Returns the delivery record for the test event.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the webhook endpoint to test.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "202": { "description": "The test event was enqueued for delivery.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "You receive the UUID for this delivery attempt.", "example": "c9a1b2c3-d4e5-6f70-8192-a3b4c5d6e7f8", "format": "uuid" }, "endpoint_id": { "type": "string", "description": "You receive the UUID of the endpoint this delivery targeted.", "example": "b8f0f4a2-2b1e-4b3a-9d0e-4a1c2d3e4f50", "format": "uuid" }, "endpoint_label": { "type": "string", "description": "You receive the label of the endpoint this delivery targeted.", "example": "Production events" }, "event_type": { "type": "string", "description": "You receive the event type that was delivered.", "example": "credential.issued" }, "event_id": { "type": "string", "description": "You receive the unique event identifier carried in the payload.", "example": "evt_9f3c1a20b7" }, "request_url": { "type": "string", "description": "You receive the URL the delivery was POSTed to.", "example": "https://api.acme.example/webhooks/didit", "format": "uri" }, "response_status": { "type": [ "integer", "null" ], "description": "You receive the HTTP status code returned by the endpoint, or null when the request never completed.", "example": 200 }, "response_time_ms": { "type": [ "integer", "null" ], "description": "You receive the round-trip time in milliseconds, or null when the request never completed.", "example": 142 }, "status": { "type": "string", "description": "You receive the delivery status (for example `delivered`, `failed`, or `pending`).", "example": "delivered" }, "retries": { "type": "integer", "description": "You receive the number of retry attempts made for this delivery.", "example": 0 }, "last_retry_at": { "type": [ "string", "null" ], "description": "You receive the timestamp of the most recent retry, or null when there was none.", "example": null, "format": "date-time" }, "created_at": { "type": "string", "description": "You receive the timestamp when the delivery was enqueued.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" } } } } } } } } }, "/v1/webhook-events": { "get": { "operationId": "getWebhookEvents", "tags": [ "Webhooks" ], "summary": "List available webhook event types", "description": "Return the full list of event type strings you can subscribe a webhook endpoint to. This endpoint is public and requires no authentication.", "responses": { "200": { "description": "The available webhook event types.", "content": { "application/json": { "schema": { "type": "object", "properties": { "events": { "type": "array", "description": "You receive every event type string available for subscription.", "items": { "type": "string", "description": "One available event type.", "example": "credential.issued", "enum": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] }, "example": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] } } }, "example": { "events": [ "offer.created", "offer.redeemed", "credential.issued", "credential.claimed", "credential.revoked", "credential.suspended", "credential.reactivated", "presentation.created", "presentation.verified", "presentation.failed", "schema.created", "schema.version_created", "trusted_issuer.added", "trusted_issuer.updated", "trusted_issuer.removed", "framework.created", "relying_party.added", "relying_party.removed", "key.rotated", "member.added", "member.updated" ] } } } } } } }, "/v1/api-keys": { "get": { "operationId": "getApiKeys", "tags": [ "API Keys" ], "summary": "List API keys", "description": "List the API keys for the tenant. Tokens are masked in this response \u2014 the full token is only returned when you create or rotate a key. Callers without API-key management permission see only their own key. The response is a bare JSON array ordered by most recent creation time.", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "A bare JSON array of API key objects (tokens masked).", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "uuid": { "type": "string", "description": "You receive the UUID for this API key.", "example": "d1e2f3a4-b5c6-7d80-9e1f-2a3b4c5d6e7f", "format": "uuid" }, "name": { "type": "string", "description": "You receive the API key name.", "example": "default" }, "environment": { "type": "string", "description": "You receive the environment for this key: `sandbox` or `prod`.", "example": "sandbox" }, "role": { "type": "string", "description": "You receive the role granted to this key.", "example": "owner" }, "created_at": { "type": "string", "description": "You receive the timestamp when the key was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "member_email": { "type": "string", "description": "You receive the member email the key belongs to, or an empty string for a tenant-level key.", "example": "dev@acme.example" }, "token_last4": { "type": "string", "description": "You receive the last 4 characters of the token.", "example": "s9Zx" }, "masked": { "type": "string", "description": "You receive the masked token for display.", "example": "sk_\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022s9Zx" } } } } } } } } }, "post": { "operationId": "postApiKeys", "tags": [ "API Keys" ], "summary": "Create an API key", "description": "Create a named API key for an environment. The full token is returned once in this response \u2014 store it immediately. A requested `role` is clamped so it never exceeds the caller's own role.", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "You optionally set a name for the key. Defaults to `default`.", "example": "CI deploy key" }, "environment": { "type": "string", "description": "You optionally set the environment: `sandbox` or `prod`. Defaults to `sandbox`.", "example": "sandbox" }, "role": { "type": "string", "description": "You optionally set the role: `owner`, `admin`, `issuer`, `verifier`, `issuer-verifier`, or `reader`. Clamped to at most the caller's role.", "example": "issuer" } } }, "example": { "name": "CI deploy key", "environment": "sandbox", "role": "issuer" } } } }, "responses": { "201": { "description": "The API key was created. The full token is returned once.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "You receive the UUID for this API key.", "example": "d1e2f3a4-b5c6-7d80-9e1f-2a3b4c5d6e7f", "format": "uuid" }, "name": { "type": "string", "description": "You receive the API key name.", "example": "default" }, "environment": { "type": "string", "description": "You receive the environment for this key: `sandbox` or `prod`.", "example": "sandbox" }, "role": { "type": "string", "description": "You receive the role granted to this key.", "example": "owner" }, "created_at": { "type": "string", "description": "You receive the timestamp when the key was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "token": { "type": "string", "description": "You receive the full API key token. Store it now \u2014 it is only returned once.", "example": "sk_live_3f9a1c...s9Zx" }, "note": { "type": "string", "description": "You receive a reminder that the token is only shown once.", "example": "Save this API key now. It will not be shown again." } } } } } } } } }, "/v1/api-keys/{uuid}/rotate": { "post": { "operationId": "postApiKeysUuidRotate", "tags": [ "API Keys" ], "summary": "Rotate an API key", "description": "Rotate an API key's token. The old token is invalidated and the new full token is returned once \u2014 store it immediately. You may rotate your own key; rotating another member's key requires API-key management permission.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the API key to rotate.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "The API key was rotated. The new full token is returned once.", "content": { "application/json": { "schema": { "type": "object", "properties": { "uuid": { "type": "string", "description": "You receive the UUID for this API key.", "example": "d1e2f3a4-b5c6-7d80-9e1f-2a3b4c5d6e7f", "format": "uuid" }, "name": { "type": "string", "description": "You receive the API key name.", "example": "default" }, "environment": { "type": "string", "description": "You receive the environment for this key: `sandbox` or `prod`.", "example": "sandbox" }, "role": { "type": "string", "description": "You receive the role granted to this key.", "example": "owner" }, "created_at": { "type": "string", "description": "You receive the timestamp when the key was created.", "example": "2026-07-02T23:51:58.746686+00:00", "format": "date-time" }, "token": { "type": "string", "description": "You receive the full API key token. Store it now \u2014 it is only returned once.", "example": "sk_live_3f9a1c...s9Zx" }, "note": { "type": "string", "description": "You receive a reminder that the token is only shown once.", "example": "Save this API key now. It will not be shown again." } } } } } } } } }, "/v1/api-keys/{uuid}": { "delete": { "operationId": "deleteApiKeysUuid", "tags": [ "API Keys" ], "summary": "Delete an API key", "description": "Delete an API key. You cannot delete the last remaining key for the tenant, nor the key currently authenticating the request \u2014 both return 409. A successful deletion returns no response body.", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "uuid", "in": "path", "required": true, "description": "UUID of the API key to delete.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "The API key was deleted. No response body is returned." }, "409": { "description": "Conflict \u2014 you tried to delete the last remaining key or the key authenticating this request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "description": "You receive the reason the key could not be deleted.", "example": "Cannot delete the last remaining API key for this tenant." } } }, "example": { "detail": "Cannot delete the last remaining API key for this tenant." } } } } } } } }, "components": { "schemas": {}, "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "description": "Tenant API key" } } }, "servers": [ { "url": "https://idv0.staging.didit.me", "description": "Staging (Amadeus POC)" }, { "url": "http://localhost:8011", "description": "Local dev" } ], "tags": [ { "name": "Other" }, { "name": "Credentials" }, { "name": "OpenID4VP Verification" }, { "name": "Status Lists" }, { "name": "Trust Registry" }, { "name": "Issuer Keys" }, { "name": "OpenID4VCI Protocol" }, { "name": "Webhooks" }, { "name": "API Keys" } ] }